(Note that Facebook now does use HSTS. The question was asked at a time when they didn't.)
To force a browser to always go directly to HTTPS for a website (and not rely on 302 redirects from the HTTP version), HSTS (HTTP Strict Transport Security) can be used.
To tell the browser that a website should always be visited using HTTPS a,
'Strict-Transport-Security' header can be sent in the HTTP response. From that moment on, the website will exist in the browser's HSTS list, and when someone types the site name (e.g.
example.com) in the URL bar, they will be sent to
https://example.com/ rather than
Google, Gmail, Twitter and Paypal are examples of major websites that make use of this functionality. Facebook, however, does not seem to send a 'Strict-Transport-Security' header in its responses. Can anyone give me a good reason why they have chosen not to use HSTS?