check for path traversal in redirect_uri

`/../`in a redirect URI allows to redirect to non-allowed URIs: http://homakov.blogspot.fr/2014/02/how-i-hacked-github-again.html

This change checks if the URI contains `/../` or ends with `/..`, and fails validation if it does. (`/./`and `/.`are disallowed too.)