IndieAuth internal user-agent should follow 307 and 308 redirects. w3c mentions 307/308 redirects: https://www.w3.org/TR/indieauth/#x4-1-discovery-by-clients