Validate host before redirect on login

Janus used to blindly redirect to `params[:return_to]` whenever the host was request.host (no security issues), but the developer was missing the possibility to interupt the redirect if the host isn't accessible for some reason. This PR thus introduces the `valid_host?` method to allow it.