[#7545] Only allow local redirects from return_to on login form
[#7545] strengthen negative test cases