Always keep https in url
If the request is already being served over HTTPS, then it would be a good idea to add a Strict-Transport-Security header to the response. Strict-Transport-Security tells the browser that, as a matter of policy, your site wants all requests to your domain to be made over HTTPS.

Be aware that redirecting an HTTP POST request would cause the browser to make an HTTP GET request. To cause the second request to also be made as a POST, you would need to respond with a a 307 status code.  Of course, the benefit of a 307 redirect of a POST is questionable, as any sensitive POST data will have already been transmitted unencrypted already.