Restrictions on redirect URIs?