def build_redirect_url(request, default_url):
    """
    Retrieve redirect url from session.
    
    Use default if retrieved one is broken or not safe.
    """
    url = request.session.get('login_redirect_url')
    if not url or '//' in url or ' ' in url:
        url = default_url
    try:
        del request.session['login_redirect_url']
    except KeyError:
        pass
    return url
