Restrict post-login redirection targets to local URLs

The login page doesn't check that the `url` parameter is a local URL before redirecting to it; e.g. <https://danbooru.donmai.us/session/new?url=http://www.example.com/> will happily take you to <http://www.example.com/>, leaving users open to phishing attacks if the target is a malicious site. This pull request only accepts `params[:url]` as a redirect target if it begins with a `/`, closing this vulnerability.