updated open_redirector attack model to reflect a small syntax change in alloy_ruby (namely that if a sig body is given in curly braces it is always interpreted as appended facts)