Escape cross-site url in redirecting