Ignore hostnames in return_to

* Extracts the path from return_to URLs
* Prevents malicious offsite redirects from phishing links

See unresolved issue 5 from:
http://blog.codeclimate.com/blog/2013/03/27/rails-insecure-defaults/