When accessed over HTTP (non-TLS), the redirect should be a 308, not a 302.

[alercah]

When LUCI is accessed over HTTP rather than HTTPS, the Cloud Platform API gateway produces a 302 redirect, which causes some clients to change a POST to a GET and thereby destroy the effectiveness of the redirect. An HTTP 308 redirect would be preferred since it instructs the client not to change request methods. This is not fixable currently since this is not under LUCI's control, but is being reported to ensure that the matter is not lost going forward.