The /init POST request is done over HTTP instead of HTTPS, posing a security issue. POST requests cannot be redirected (they turn into GETs), so this isn't fixable on the user side beside allowing plaintext HTTP.
Monorepo for Tangled
tangled.org