Feature/block redirect to host not allowed

[steinkel]

The patch provided covers the case when:

• The redirect query param points to an external host
• The redirect url is allowed for the logged in user (there is a rule allowing the controller/action/etc)

^ In this case, a redirect was possible to an external domain

AFTER the patch, the redirect only happens if the domain is included in Users.AllowedRedirectHosts