core: add hostname to auth redirect