Next links can be misused

[stuartmscott]

Next links (like '/sign-in?next=%2Faccount') can be misused to redirect users to another page (eg '/sign-in?next=%2F%2Fstripe.com')

Options:

1. Whitelist next values - though this will get tricky (eg /sign-in?next=%2Freply with conversation and message id)
2. Strip double forward slash from next values to prevent redirect to another site - though this doesn't stop redirects to other parts of Convey
3. Store next value in an encrypted cookie

(cc @Kostadin)