Fix URL validation

This addresses two issues with validation of URLs given as URL parameters.

On the one hand this does a bit of refactoring concerning `ret_url`/`came_from` (see #574) and provides input validation in a central place. On the other hand this improves the validation used when linking to overlays (see #553/#555).

While the one is implemented in python on the server and the other in JavaScript on the client I tried to make the validators as similar as possible.