An automated kiosk which shows "/views/monitor" on Jenkins gets to Jenkins home page after the plugin version is updated to 2.4.2.

I believe this change broke it: https://github.com/jenkinsci/keycloak-plugin/pull/33/changes

It checks for `Util.isSafeToRedirectTo(referer)`, where `referer` is a `Referer` header. Browser sets it to an absolute URL.

Documentation for `isSafeToRedirectTo()` says "Return true if and only if the parameter does not denote an absolute URI and not a scheme-relative URI".

This is implemented correctly with a check for Jenkins root URL in github-oauth plugin: https://github.com/jenkinsci/github-oauth-plugin/blob/53b0704550638b59bced57eff2ac776161d38ad6/src/main/java/org/jenkinsci/plugins/GithubSecurityRealm.java#L338-L350