Why then, is it possible for a site served over HTTPS to redirect to a HTTP URL with a
Content-Disposition: attachment or
Content-Type: binary/octet-stream header that forces a download?
For example this download page is served initially over HTTPS but redirects the user to an insecure download URL. Chrome just blindly automatically downloads the file and presents no information as to its origin. Firefox does show the origin in its download dialog but still allows the download to proceed and doesn't warn the user at all: