It does. The problem is in Apache, not the language. Apache's says to look into the HTTPS variable (that it adds itself before passing the call to the handler)

It does. The problem is in Apache, not the language. Apache's says to look into the HTTPS variable (that it adds itself before passing the call to the handler) to know if the call was made over https, but then it overwrite that variable with the browser-sent header if there is one (or more exactly, it uses the same variable name for that header and it's own HTTPS indicator; so it overwrites if both are present, and if only the header is present then it creates it when it shouldn't -- the issue in this post).