Web Applications - Refactoring HTML: Improving the Design of Existing Web Applications - page 252

When the browser receives the 301 response, it will GET the URL specified by the Location header. This page
can then be bookmarked, linked to, and so forth. If this page contains private data, the server can require
authentication just as it can with any other page. If it's very private, the Location header can redirect the
browser to an https URL instead of an http URL. Because this is just a regular GET, it fits well into existing HTTP
frameworks and tools on both the client and server sides.