Fix open-redirect via next parameter, remove dead code

internal/web/auth_handlers.go

@@ -47,10 +47,7 @@ func (h *Web) handleLogin(w http.ResponseWriter, r *http.Request) {
 	}
 	_ = database.TouchLastLogin(h.DB, user.ID)
 
-	if next == "" || next[0] != '/' {
-		next = "/"
-	}
-	http.Redirect(w, r, next, http.StatusFound)
+	http.Redirect(w, r, safeRedirectPath(next), http.StatusFound)
 }
 
 func (h *Web) loginFailed(w http.ResponseWriter, r *http.Request, next string) {