use trusted redirect

node_modules/connect-architect/connect.redirect/redirect.js

@@ -1,11 +1,23 @@
 "use strict";
 
+var url = require("url");
+
 module.exports = function(options, imports, register) {
     
+    var trustedHosts = options.trustedHosts || {};
+    
     imports.connect.addResponseMethod("redirect", function(location) {
         this.writeHead(302, {Location: location});
         this.end("");
     });
+    imports.connect.addResponseMethod("secureRedirect", function(location) {
+        var parsedLocation = url.parse(location);
+        if (!(location.host in trustedHosts))
+            location = parsedLocation.path;
+            
+        this.writeHead(302, {Location: location});
+        this.end("");
+    });
     imports.connect.addResponseMethod("returnTo", function(req, defaultReturn) {
         var url = defaultReturn || "/";
         if (req.session && req.session.returnTo) {