I see, thanks for explanation (I forgot about the actual data sent to webserver, and thought redirects would handle this).

I think the fix for this would be to change everywhere in fossil's code which generates webpages to just so that it prints them like this:

<pre>
<form method="post"
</pre>

<pre>
<form method="post"
</pre>

This will use whatever protocol (http or https) this page were originally, and yes, this is in RFC, and supported by all browsers.

Even better, though harder, would be making all links relative.