Safe merge with params for redirect_to (addresses issue #191)

Malicious request:
http://localhost:3000/projects?host=evil.example.org
Redirect target before:
http://evil.example.org:3000/pt/projects
Redirect target after:
http://localhost:3000/pt/projects