I *think* the intent is to prevent a security problem where I send you a link like https://transition.production.alphagov.co.uk/site/foo/mappings?return_to=http://malicious.com but this isn't clear in the comment - `site` might mean another site in the app.

Additionally, now that this is a path, rather than a URL, could we change it to simply check that it starts with a `/`?