Prevent open redirect vulnerabilities when redirecting after login

@hypatia correctly reports that our current implementation allows creating URLs that end up redirecting to arbitrary ones. Shame on me, I even wrote an arbitrary redirection in the tests and didn't notice that it could be a security issue :scream:

This PR tries to fix the problem by enforcing the current app's host in the `return_to` parameter before using it to calculate the redirection.

If the hosting app wants to redirect somewhere else, the right way would probably be redirecting back to the app itself to whitelist/sanitize the destination URL and perform the redirect to the resulting URL afterwards.