Security: sanitize potentially unsafe data before it is used in header redirects (revised)

There are a few spots in the current codebase where unsanitized user and system data is directly used in a header() redirect. This pull request uses the new Security helper to sanitize input where appropriate.

More information: https://www.owasp.org/index.php/Open_redirect

In the [original pull request](https://github.com/concrete5/concrete5/pull/1006), @mkly provided some feedback that helper methods should not be called statically in Concrete5. I've modified the Security helper to reflect this and swapped in Loader::helper() wherever it was previously called statically.