client: use 307 instead of 302 for HTTPS redirects