Private folder incorrectly reported as accessible for https host

We have a server that has ssl forced - e.g., any requests for http://our.server.edu/ are automatically redirected to https://our.server.edu/. That creates a problem with the security checking code, as it tries to open a socket to port 80 on the same server, receives a 302, and concludes that the file is accessible. I'm attaching a patch to fix this issue...

thanks,

Adrian