Fix for three open redirect vulns using redirect_to url_for(params.merge)))

See merge request !2082