don't redirect to absolute uri

this fixes https under reverse-proxy.
rfc-compliant location headers are stupid anyway