Implemented the unvalidated redirects and forwards vulnerability

The login page will not accept a returnURL parameter for when the user
logs in. The fix for this was using part of the MVC source code.