web-player: fix open redirect via returnTo, require SESSION_SECRET and validate API inputs

web-player/src/routes/auth/+page.server.ts

@@ -1,9 +1,11 @@
 import { redirect } from '@sveltejs/kit';
 import type { PageServerLoad } from './$types';
+import { safeReturnTo } from '$lib/server/auth';
 
 export const load: PageServerLoad = ({ locals, url }) => {
+	const returnTo = safeReturnTo(url.searchParams.get('returnTo'));
 	if (locals.user) {
-		redirect(302, url.searchParams.get('returnTo') ?? '/');
+		redirect(302, returnTo);
 	}
-	return { returnTo: url.searchParams.get('returnTo') ?? '/' };
+	return { returnTo };
 };