respect subdomain origins on post-auth redirect [fixes #61760192]