check for path traversal in redirect_uri