What are the valid URLs for LICENSE-2.0 at apache.org?

This question is a bit weird, but I was requested to bring it up on RAT-212.

Ultimately, the question is really about the canonical URL for references to the AL, 2.0 at apache.org.

Here's some variants:

1. http://www.apache.org/licenses/LICENSE-2.0
2. https://www.apache.org/licenses/LICENSE-2.0
3. http://www.apache.org/licenses/LICENSE-2.0.html
4. https://www.apache.org/licenses/LICENSE-2.0.html
5. http://www.apache.org/licenses/LICENSE-2.0.txt
6. https://www.apache.org/licenses/LICENSE-2.0.txt

Which is the canonical location to reference?
Which of these would LEGAL consider valid for automated tooling to verify a requirement to reference the AL, 2.0 license at apache.org has been satisfied? All of them? A subset?

The license header blurbs we use have only http, but would the license header requirement still be satisfied fully if a project edited the text to reference the equivalent https URL?

I wouldn't expect an https reference to substantively change the meaning of the reference when they serve the same content (https just does so more "securely")... and I personally prefer https wherever possible. It is possible a webserver would serve different content on http vs. https, but apache.org doesn't (at least not for the license). I also wouldn't expect the reference to be less valid if it points to the txt or html version, or whether it has the optional html file extension. But, perhaps LEGAL has a stricter opinion?