Code review at HEAD 7286d320. Security-001 (High): guard returnUrl with a local-URL check before redirect (open-redirect/phishing vector) + regression test. Security-002: update stale LdapOptions dev-LDAP doc reference.
7286d320