Escape URLs when checking for cross-origin redirects