always redirect to current page from login
allow xss for redirectTo query parameter