Move exclude option inside force_ssl config so /health endpoint is not redirected to HTTPS (needed for k8s readiness probe).
Prevents excessive 301 redirect logs from Kubernetes health probes