Check login redirect_uri / next parameters against protocol-relative //evil.com, backslash, and @ open-redirect bypasses.