[security feature] Require explicit opt-in for allowing redirect http->https

[jacalata]

This redirect is a required feature for some enterprise networks, but it's also raised as a security hole by some reviews. We should do an active switch to making it fail by default and allow users to specify the behavior if needed.