Add XSS protection for redirectTo

* Add unit tests for Url