As http and https are separate origins, and this website might want to have secure cookies, I'm guessing that a while back they started moving to a more modern

As http and https are separate origins, and this website might want to have secure cookies, I'm guessing that a while back they started moving to a more modern / secure web stack but had to figure out how to deal with legacy ~ URLs and made the decision not to break all of those URLs but instead just continue to serve them only as http and then have the rest of the website redirect to https. The reality is that, if you insist on redirecting http to https even when the underlying website doesn't want you to, you are going to end up with a broken experience sometimes and it frankly isn't notable.