So rare that I'm not sure why this got any attention. There are more interesting bugs to look at, which i do see in the wild a lot (e.g. redirect_to params[:return_url])
That should be something like /\A(http(s?):\/\/#{request.host_with_port}|\/\Z|\/[^\/])/