Signing in no longer sends you off-site

A magic link could carry a destination like //evil.example, and /access would send the person there right after a real sign-in. Every destination now passes one rule, twice.