redirect defaults to 303 (#5898)