Limit allowed return_to URLs #516
Description
concern (out of scope): does this mean that ALL URLs in the domain are allowed as return_to? I think that this was intentional, but we should limit it to just the login UI (seems like a security concern)
Originally posted by @nsklikas in #506 (comment)