[nailer]

HTTP version really should redir to HTTPS.

[eridius]

That won't really fix anything, anyone who wants to MITM the HTTP can just kill the redirect.

[Tushon]

Not with HSTS enabled (which they do have). If you get caught before the first request ever, sure, but you've got bigger problems if that is the case.