This is an interesting downgrade attack for sure. The author didn't bring this up, but this will probably work around HSTS if you have your site set up and preloaded into the browsers HSTS list.