Only allow relative signin redirects