Change how redirects are handled #53
Description
Currently, redirect handles before/after auth are defined in the environments (server) or config file (client). Perhaps I can just pass a "redirectTo" query parameter? The concern is if someone maliciously changes that in the client side. CORS should protect from that, but CORS doesn't work for GET requests, so maybe it is fine to keep it as is?
The session where their access token is stored is on my server, so I'm not sure that redirecting to a malicious server would necessarily be problematic, aside from the end-user not understanding why they were misdirected.