Validate destination before redirecting user
Validate destination before redirecting user

This prevents us from being an open redirect if an IdP becomes rogue
or compromised.

Fixes: CVE-2016-1000001
Signed-off-by: Patrick Uiterwijk <cbb7353e6d953ef360baf960c122346276c6e320@puiterwijk.org>

puiterwijk/flask-oidc,SteelPangolin/flask-oidc