[security] Some improvement to after url managing.

* allow keep previous payum token, lets say you want to generate a refund link and set url which  already have a token. It keeps the token already set in url.
* The other case, you do not need any token in the url. you want to redirect to another domain, server which could not verify the token hence it is useless to add it.
Should pass `2` as 3rd arg for explode to make sure it splits only in 2 parts