Function send 

fn send(
    method: &str,
    url: &str,
    bearer: Option<&str>,
    body: Option<&[u8]>,
    sink: &mut dyn FnMut(&[u8]) -> bool,
    progress: &'_ mut dyn FnMut(u64, Option<u64>),
    cancel: &AtomicBool,
) -> Result<(), HttpError>

Follows redirects itself, since WinHTTP left to itself re-sends the bearer token to whatever origin a 3xx names (measured 2026-10-30).

The token goes only while scheme, host and port match what the caller asked for, https may never become http, and a request carrying a body is not redirected at all, rather than quietly re-sent or turned into a GET.