[security] fixed back url verification

same PR @marutosi did in his PR against the `migrate/1.5_to_2.4` branch.

see:

* http://www.redmine.org/news/90
* http://www.redmine.org/projects/redmine/wiki/Security_Advisories/13