#961: don't rely on $_POST['redirect_url']