Why do open redirects work?