Added url checks for redirect destination

Closes #3478572

Refactors the destination logic to a new session method to confirm if an external domain is set in the session and validates that it is external and local before allowing it to be used.