Added a check to make sure the from parameter redirect is a relative url

This should protect against an open redirect attack. See

https://www.owasp.org/index.php/Open_redirect