Redirects stay on Kumir

redirectFromSearch only allows same-origin paths. Default return is /login.

redirect_to and next must start with a single slash. Protocol-relative, external, and @-host tricks fall back to /login.

After a valid password update, web lands on /login?reset=1.