I get two different onebox too, one HEAD request using a browser user-agent, and one GET request using an identifiable user-agent. If the HEAD request is redirected (to a challenge page), three requests follow, all to the redirected page.
I have to whitelist all HEAD requests in our challenge system for onebox to work. Not only inline-onebox, but block onebox as well.