tightening regex rules for login/logout redirects