FAQ: additional notes on getting HTTPS redirects right