Six lines guard every ?next= in our app, and the case people miss is a backslash

Validating a post-sign-in redirect by parsing it and comparing origins is the approach that looks rigorous and quietly accepts /vil.example. A prefix allowlist is shorter, dumber, and does not have that hole. Here is the evidence, run in Chrome.