also catch wildcard protocols like //google.it

node_modules/connect-architect/connect.redirect/redirect.js

@@ -14,10 +14,10 @@ module.exports = function(options, imports, register) {
         this.end("");
     });
     imports.connect.addResponseMethod("secureRedirect", function(location) {
-        var parsedLocation = url.parse(location);
-        
+        var parsedLocation = url.parse(location, false, true);
+
         if (!trustedDomainsRe.test(parsedLocation.host))
-            location = parsedLocation.path;
+            location = parsedLocation.path || "/";
            
         this.redirect(location); 
     });

package.json

@@ -90,6 +90,7 @@
         "c9.ide.imgeditor": "#612e75ef4f",
         "c9.ide.immediate": "#a962119bec",
         "c9.ide.installer": "#0fde9f0067",
+        "c9.ide.language.python": "#undefined",
         "c9.ide.mount": "#b9a5a2d45c",
         "c9.ide.navigate": "#38ae100ea1",
         "c9.ide.newresource": "#981a408a7b",