avoid set_language redirect to different host

[Gunnar]

    next = request.REQUEST.get('next', None)
    if not next:
        next = request.META.get('HTTP_REFERER', None)

HTTP_REFERER can be from different host, specially when using an external SSO Authentication provider.
Then redirecting causes an infinite loop.
Solution:
Like in django.contrib.auth.login:

    next = request.REQUEST.get('next', None)
    if not next:
        next = request.META.get('HTTP_REFERER', None) 
        netloc = urlparse.urlparse(next)[1]

        # don't allow redirection to a different
        # host.
        if netloc and netloc != request.get_host():
            next = '/'

[Claude Paroz]

Check REFERER before redirection

[Florian Apolloner]

We also need to check the rest of the codebase for similar issues and factor this stuff out into a utility function like:

def safe_redirect(request, redirect_to):
  # check redirect_to against request.get_host() or so here...

[Florian Apolloner <florian@…>]

In 1515eb46daa0897ba5ad5f0a2db8969255f1b343:

[1.3.X] Fixed #18856 -- Ensured that redirects can't be poisoned by malicious users.

[Florian Apolloner <florian@…>]

In b2ae0a63aeec741f1e51bac9a95a27fd635f9652:

[1.4.X] Fixed #18856 -- Ensured that redirects can't be poisoned by malicious users.

[Florian Apolloner <florian@…>]

In fce1fa0f7fb984d4e76eb81ffc3cb9826046c3b5:

[1.5.X] Fixed #18856 -- Ensured that redirects can't be poisoned by malicious users.

[Florian Apolloner <florian@…>]

In a2f2a399566dd68ce7e312fff5a5ba857066797d:

Fixed #18856 -- Ensured that redirects can't be poisoned by malicious users.