thanks for pointing this out. You're right, there is an open redirect vuln in here, and also one in `shib-login/?next=<url>`.  I had thought django.shortcuts.redirect would check for these, but it turns out not.  In any case I wrote a checker function in external_auth