http: limit redirection to protocol-whitelist