Don't accept params[:to] as in redirect_to

It is (severe client side vulnerability)[http://homakov.blogspot.com/2013/11/stealing-user-session-with-open.html]. For a while I've been noticing this in many high-profile applications including songkick, airbnb and others.