check for path traversal in redirect_uri
CS fixes