The spec accepts all redirect status codes, as listed in the fetch spec, including the permanent ones: 301 and 308.

Since 301 and 308 inform clients that the redirection is permanent, they might cache the URL found in the Location header, and stop calling the URL that triggered the redirection (here, the well-known URL)
I remember Firefox doing this at some point, and some proxies might also do this.

We can't be sure that website maintainers will not change the URL of their "change password" page. With permanent redirect status codes, some users might land on the old page, or on a 404.

This could be avoided by limiting the redirection status code to 302, 303, and 307.