Is there validation anywhere that this redirectUrl doesn't go to an external site? We would want to avoid an [Open Redirect vulnerability](https://www.owasp.org/index.php/Open_redirect)