Local url validation and forms auth fix to fix #893

Added a new extension method on context to validate whether a url
path is local to the current request.

Plumbed in the new method to forms auth so it only redirects to
to a querystring url if it's local.
Merge pull request #895 from grumpydev/OpenRedirect-893

Local url validation and forms auth fix to fix #893