SEC-1947: Make DefaultRedirectStrategy.calculateRedirectUrl protected to allow custom implementations