Return link without validations is potentially unsafe

[LukasKalbertodt]

The feature introduced in #674 is problematic. This was noticed by @luniki. Some article about this security concern: https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html

One solution would be to have a whitelist of domains that can be redirected to. That whitelist would only be configurable via settings.toml and NOT via GET parameters. This would also mean that other apps already using return.target and return.label don't have to change.