make sure redirection is indeed TLS upgrade