Comment by chuckhoupt

Note that HTTP is also upgraded if the UA requests it with the Upgrade-Insecure-Requests header:

  $ curl -I -H 'Upgrade-Insecure-Requests: 1' 'http://www.w3.org/Provider/Style/URI.html'
  HTTP/1.1 307 Temporary Redirect
  location: https://www.w3.org/Provider/Style/URI.html
  vary: Upgrade-Insecure-Requests