Limit redirecting only to local or whitelisted domains

[dmitriim]

Currently on logout you can redirect to any URL. Would be more secure to redirect only to internal pages and whitelisted pages. I guess we need a new setting for that.

[brendanheywood]

I would treat the open redirect as a bug and fix that, and treat the whitelist as a bonus points new feature - yes it worked in the past but its an undocumented bug rather than an explicit feature

[dmitriim]

Agree we should fix it brutally by limiting to local URLs only and leave this one open as an enhancement for those who may be suffering.

[dmitriim]

After landing #99 we are redirecting only to internal pages. Which is not ideal and can potentially break some functionality.

Next step would be introducing a new setting for whitelisting domains for redirecting.