We're currently trying to handshake for TLS, and when that fails with GNUTLS_E_UNEXPECTED_PACKET errors, we redirect to HTTPS. A better solution would perhaps be to actually check the request for the TLS signature bytes, avoiding the handshake, and redirecting when we don't encounter them.
*** This bug has been marked as a duplicate of bug 4580 ***