don't let the login redirect be an open redirect