Fix possible open-redirect with ALLOW_SUBDOMAIN option. (#1223) (#1225)