[security] fixed back url verification

This are the same changes @marutosi did in his PR against the `migrate/1.5_to_2.4` branch except it is posted against the `dev` branch.

Backporting to `stable` should be done once the tests ass.

see:

* http://www.redmine.org/news/90
* http://www.redmine.org/projects/redmine/wiki/Security_Advisories/13