Validate return_url before storing it in the session: only relative paths starting with "/" (and not "//") are accepted. Anything else — absolute URLs and protocol-relative URLs — is replaced with "/". Add tests covering the accepted and rejected cases. Signed-off-by: Matías Insaurralde <matias@insaurral.de>