Make SECURITY_POST_LOGIN_VIEW work when 'next' is blank

If a user goes directly to /login, the value of 'next' is the empty string in the login form.
This change updates validate_redirect_url() so that the empty string does not validate, and get_post_action_redirect() will fall through as expected to SECURITY_POST_LOGIN_VIEW.