Take a look at the ssl_requirement plugin.
Shouldn’t it check to see if you’re in production mode? We’re seeing a redirect to https in development mode, which seems odd. Or is that the normal behavior for the plugin? I thought it behaved differently in the past.
I guess they believe that you should probably be using HTTPS (perhaps with a self-signed certificate) in development mode. If that’s not the desired behaviour, there’s nothing stopping you from special casing SSL behaviour in the development environment yourself: