Do not allow redirect to absolute URL (fix #2)