This is an interesting one, because I've recently been very frustrated with Firefox and captive portals, as it attempts HTTPS first, then ends up retaining HSTS - it's a difficult one to get right though, and I agree that attempting HTTPS first is a better idea.