:only_path=>true prevents redirect host hijacking