improved redirectTo domain validation