Consider protocol relative URLs as non-local

During a vulnerability scan a URL Redirection exploit was raised as part of the Forms Authentication login. Basically, spoofing the returnUrl parameter to an external host in format "//nancyfx.org" will redirect the user here after successful authentication.

Request Headers:

>POST /login?returnUrl=//www.acunetix.com HTTP/1.1 
>Content-Length: 46 
>Content-Type: application/x-www-form-urlencoded 
>Host: ourhostname.com
>Connection: Keep-alive 
>Accept-Encoding: gzip,deflate 
>User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36 
>Acunetix-Product: WVS/9.0 (Acunetix Web Vulnerability Scanner - NORMAL) 
>Acunetix-Scanning-agreement: Third Party Scanning PROHIBITED 
>Acunetix-User-agreement: http://www.acunetix.com/wvs/disc.htm 
>Accept: */* 

>Password=t3st&UserName=my@email.com 

Response Headers:

>HTTP/1.1 303 See Other 
>Cache-Control: private 
>Content-Type: text/html 
>Location: //www.acunetix.com 
>Server: Microsoft-IIS/7.5 
>Set-Cookie: _ncfa=JYCo5%2ftUHvCTg2rU8DAUHFbd1LZ7bAvqX09QBN%2besVU%3dA08XQRflpHzohrGhRKNkUiAd%2bj4PR4 zxtT%2fbiTCjlj01zbNaHhnZLUP%2bPlHj9OdQ; path=/; HttpOnly 
>X-AspNet-Version: 4.0.30319 
>X-Powered-By: ASP.NET 
>Date: Thu, 12 Jun 2014 12:04:44 GMT 
>Content-Length: 0 
>Connection: Keep-Alive