Check origin before redirecting users with default JS.

Prevents issues like phishing attempts on sites that allow users to post HTML (users posts a link with data-next and the right class, user logs in and then thinks they're on the same site when they got redirected to attack site).