Use flask_openid safe_roots for Covert Redirect.