Hardened security against malicious redirects

Auth paths now reject open-redirect attacks using backslashes or control characters, and agent tokens whose scopes exceed the user's approved consent are properly rejected on reconnect.