Do only follow HTTP and HTTPS redirects

We do not want to follow redirects to other protocols since they might allow an adversary to bypass network restrictions. (i.e. a redirect to ftp:// might be used to access files of a FTP server which might be in a secure zone and not be reachable from the net but from the ownCloud server)
It sucks that you have to give the string length you're comparing to to substr. Hence I would recommend using stripos() === 0 and remove the strtolower.