open redirect vulnerability fix