fix bug 892639 - Don't allow external REDIRECT urls