Triple slash

So, 
1.9.3p194 :022 > URI.parse('///x.com').host
 => nil
1.9.3p194 :023 > URI.parse('///x.com').path
 => "/x.com"
and this is completely valid. 

But browsers don't think so. They *fix* ///x.com to //x.com and load scheme-relative URL, e.g. https://x.com.
That opens an open redirect vulnerability on every redirect validation that relies on .host checks and doesn't prepend actual hostname.
I mean such code
url = URI.parse(params[:to])
if !url.host or url.host == 'samesite.com'
  redirect params[:to]
end