Restrict post-login redirection targets to local URLs
Merge pull request #1813 from kxz/login-redirection

Restrict post-login redirection targets to local URLs