Sign redirect to remove OpenRedirect attack vector

[Akron]

The server side redirect based on the OAuth client registration should be signed to avoid open redirect attacks.