im not really sure why the tile handler serves up tiles from both urls (perhaps to distribute load), but i've never seen the same behavior when "services" itself is used to denote the hosted content instead of "server" (because "server.arcgisonline.com" automatically redirects in the browser to "services").
either way, glad my suggestion resolved your problem.