Take redirects off the Host header.

Same-site redirects are now relative paths, and a saved page on another site is ignored. The HTTP to HTTPS redirect takes its host from the new SITE_URL setting, and without it the pages refuse plain HTTP.

publish/edit.php

@@ -1,13 +1,11 @@
 <?php
-if ( ! isset($_SERVER['HTTPS'])) {
-   header('Location: https://' . $_SERVER["SERVER_NAME"] . $_SERVER['REQUEST_URI']);
-   exit;
-}
+require_once('../config.lib.php');
+require_https();
 require_once("../session.lib.php"); 
 if (!isset($_SESSION['editor'])) {
   $is_admin = FALSE;
   session_write_close();
-  header("Location: https://xxx.org.za/publish/login");
+  header("Location: /publish/login");
   return;
 }
 ?>