Let me rephrase my previous question "So why does my first example actually work even for https sites?" to "So why does my first example actually work even for https sites in an ssl-bumped setup (the same as in example 2)?"