The vulnerability would be more directed toward, for example, the GET request to `/api/auth/shibboleth`, as someone can forge a link that says:

https://lib.collab.ac.cam.uk/api/auth/shibboleth?redirectUrl=http://my.attack.site/that/looks/like/cambridge/oae

that tricks users into thinking they're going to cambridge OAE