GUI-274: Prevent arbitrary redirects in login handler