Notes about 'Scheme-relative URLs' in dest redirect (security)