updated open_redirector attack (fixed a small mistake in TrustedServer which allowed it to arbitrarily send HttpResp to the client)