The redirect url right now is not validated against a list of restricted host names. A configuration has to be introduced restricting the hosts the user could be redirected to.