I assume we need to do the same isExternal() checking as done with the "next" parameter.  So instead of "u", construct "next" and then test it.  It seems possible otherwise to cause a redirect outside the website, which is a security risk.