views.login: fix open redirect.