Safer post-booking redirect URLs

The post-booking redirect URL on an event now accepts only web addresses. Links that start with http:// or https:// work, and a bare domain such as www.example.com now gets https:// added so the redirect lands on the right page. Other link types, and paths such as /pages/thank-you, are rejected with a message in the event form. Existing events with a valid URL do not change.