Fix login/logout redirect vulnerability