Maybe we don't have to check the redirected URL here. `if not ('SSL' in url)` is enough?

If we test `response.url`, it should start with `https://` but won't include `SSL`.