Ensure redirect_to stays within the same domain