This PR fixes a security vulnerability where the delete endpoints were using the HTTP Referer header without validation, which could lead to open redirect attacks.

Changes Made

• Added a get_safe_redirect_url function that validates redirect URLs
• Modified the delete and bulk_delete endpoints to use this function
• Ensures redirects only go to the same domain as the request

Security Impact

This change prevents attackers from redirecting users to malicious sites after delete operations, which could be exploited for phishing attacks.

Testing

I've tested this fix by:

1. Verifying that legitimate redirects still work properly
2. Confirming that attempts to redirect to external domains are blocked
3. Ensuring the default redirect works when no referer is present

Fixes #184