Redirects stay on Kumir

redirectFromSearch only allows same-origin paths. Default return is /login.

redirect_to and next must start with a single slash. Protocol-relative, external, and @-host tricks fall back to /login.

After a valid update, web still lands on /login?reset=1 with that safe return attached.