It was possible to cause this controller to redirect to an arbitrary domain.

This has been stopped as it could have reputational issues
Some extra test files that cropped up while running tests.
Merge pull request #1852 from guardian/preferences

Preferences controller can no longer redirect to arbitrary domains.