Fix is_safe_url checks

Unfortunately, I completely missed the host argument to is_safe_url.
Without it, the check will have always returned False (see #1557).

This change fixes this behaviour. Unfortunately, it does require
changing the notation of the safe_referrer and redirect_to_referrer
utility functions.