Can we have a short comment to explain the security need for checking what the return_url starts with.