redirect whitelist

- redirect now used for payment options
- github ribbon opens in _blank now
- illegal redirect now yields 406 error