Maybe a plugin done that .In the previous domain I used cloudfront flexible ssl plugin .Maybe that plugin do those changes but I am not sure at all.