User supplied 'goto' param validation needs to be confirmed with FT

Authentication using trees can handle a user defined URL parameter of "goto" which should define the successUrl once authentication succeeds. Since this parameter is user defined, it is open to abuse and needs to be validated. There currently is validation, but this needs to be confirmed with Functional Tests.