302 for non-HTTPS requests