Take redirects off the Host header.

Same-site redirects are now relative paths, and a saved page on another site is ignored. The HTTP to HTTPS redirect takes its host from the new SITE_URL setting, and without it the pages refuse plain HTTP.

tests/php/Pages/HttpsTest.php

@@ -0,0 +1,23 @@
+<?php
+namespace Xxx\Tests\Pages;
+
+use Xxx\Tests\Support\PageTestCase;
+
+// require_https() in config.lib.php when SITE_URL is empty
+class HttpsTest extends PageTestCase {
+  protected static function serverEnv(): array {
+    // proc_open() drops a variable with an empty value, so use a blank one
+    return array('SITE_URL' => ' ');
+  }
+
+  public function testWithoutASiteUrlPlainHttpIsRefused(): void {
+    $answer = $this->get('/publish/login', array('X-Test-Plain' => '1'));
+    $this->assertSame(403, $answer['status']);
+    $this->assertNull($this->header($answer, 'Location'));
+    $this->assertSame("This page needs HTTPS.\n", $answer['body']);
+  }
+
+  public function testWithoutASiteUrlHttpsStillWorks(): void {
+    $this->assertSame(200, $this->get('/publish/login')['status']);
+  }
+}