security patch: only allow redirect to local url