Take redirects off the Host header.

Same-site redirects are now relative paths, and a saved page on another site is ignored. The HTTP to HTTPS redirect takes its host from the new SITE_URL setting, and without it the pages refuse plain HTTP.

session.lib.php

@@ -136,6 +136,15 @@ function csrf_valid($token = NULL) {
          hash_equals((string)$_SESSION['csrf_token'], $token);
 }
 
+/*
+ * TRUE for a path on this site, such as "/article?id=1". A browser sends
+ * a redirect to "//host" or "/\host" to another site, so those are not
+ * local paths.
+ */
+function is_local_path($path) {
+  return is_string($path) && preg_match('#^/(?![/\\\\])#', $path) === 1;
+}
+
 /*
  * Log an editor in under a new session id, so that a session id that
  * someone planted or saw before the login is of no use afterwards.