Auto-redirect for in-site links, and show 404 for external links (to avoid open redirect or phishing)