Stricter checking for requested redirect_uri.

For a URL, the protocol and host must match and the registered
redirect must be a substring of the requested uri. For a non-URL,
an exact match is required.