Fix open-redirect via next parameter, remove dead code

internal/web/web.go

@@ -36,6 +36,17 @@ func (h *Web) page(w http.ResponseWriter, r *http.Request, name, active, title s
 	})
 }
 
+// safeRedirectPath returns next if it's a same-site relative path, or
+// "/" otherwise. Guards against open redirects: a bare "/foo" is fine,
+// but "//evil.com" or "https://evil.com" are protocol-relative/absolute
+// URLs a browser would follow off-site.
+func safeRedirectPath(next string) string {
+	if next == "" || next[0] != '/' || len(next) > 1 && next[1] == '/' {
+		return "/"
+	}
+	return next
+}
+
 func (h *Web) flash(w http.ResponseWriter, r *http.Request, name, active, title, flash, kind string, data any) {
 	render(w, name, PageData{
 		Active:    active,