Have you tried setting both requireSSL and enableCrossAppRedirects to true in the web.config file?