Correct and `redirect_to_secure` check

In some cases the domain and the secure domain would match. The correct
check would be to redirect whenever the current request is not secure.

This would work in cases when the domain and the secure domain differ as
well.
This ensures this test is correctly failing with the old code rather than giving an error.