Validate rs/oauth redirect_uri before storing return URL

spec/controllers/rs/oauth_controller_spec.rb

@@ -222,6 +222,19 @@ RSpec.describe Rs::OauthController, type: :controller do
 
         expect(response).to redirect_to(new_user_session_path(cn: user.cn, ou: user.ou))
       end
+
+      context "without a redirect_uri" do
+        it "returns a 400 without storing the return location" do
+          get :new, params: {
+            username: user.cn,
+            scope: "documents,photos",
+            client_id: "https://example.com"
+          }
+
+          expect(response.response_code).to eq(400)
+          expect(session[:user_return_to]).to be_nil
+        end
+      end
     end
 
     describe "root access" do