Refs #3 - Do not use user's 'next' URL if it is not safe

Do not redirect to arbitrary remote locations