It depends on how the app is displaying the link. They could be setting all sorts of cookie info/metadata in the original http request. There are many answers as to why it is accepted. I'm obviously not the developer of the valve app so I can't tell you exactly.
What doe cookies and metadata have to do with certificate validation?
The http link could theoretically be serving the cert to the device. I'm not sure WHY they would do this, just guessing. However, the redirect makes it seem intentional for whatever reason.