Function safe_redirect_target 

pub fn safe_redirect_target(next: Option<&str>) -> String

Only accept local, absolute paths as redirect targets (prevents open redirects via ?next=https://evil.example).