I know this post is old but "ip http secure-server" doesn't work for URL redirect during posturing in my experience.  You need "ip http server." I also recommend adding the supplemental command, "ip htp active-session-modules none" unless you manage ...