Reveal the intent of checking the return_path
Tighten return_path check
Add tests for preventing malicious redirects
Refactor off-site checks into shared code

Also add more tests.
Treat nil as not being an on-site path

This simplifies the code a bit.
Merge pull request #217 from alphagov/tweak_return_path_check

Tweak return path check