SLING-3443: Parameter based redirection vulnerability in FormAuthenticationHandler

*FormAuthenticationHandler* didn't url encode the parameter(*Authenticator.LOGIN_RESOURCE*) before redirection. This leads the attacker to use this parameter to redirect to a different domain. This may also help in phishing attacks. 

This was initially spotted in one of our applications which use org.apache.sling:org.apache.sling.auth.form:1.0.2

This pull request fixes the vulnerability (plus a testcase too).