redirect here should be for a full http url, e.g.
http://my_auth_server/login?...
otherwise (and I noticed it) it will work but we will get ugly behavior like
redirecting to "cnn.com/login?" and showing our page here which could confuse users