Triple slash

So, 
```
1.9.3p194 :022 > URI.parse('///x.com').host
 => nil
1.9.3p194 :023 > URI.parse('///x.com').path
 => "/x.com"
```
and this is completely valid. 

But browsers don't think so. They *fix* ///x.com to //x.com and load scheme-relative URL, e.g. https://x.com.
That opens a possible open redirect vulnerability on every redirect validation that relies on .host checks and doesn't prepend the hostname (responds with Location: ///relativepath).
I mean such code is vulnerable.
```
url = URI.parse(params[:to])
if !url.host or url.host == 'samesite.com'
  redirect params[:to]
end```