def register(request, registration_form=RegistrationForm):
    if request.user.is_authenticated:
        return redirect(request.GET.get('next', reverse('spirit:user:update')))

    form = registration_form(data=post_data(request))
    if (is_post(request) and
            not request.is_limited() and
            form.is_valid()):
        user = form.save()
        send_activation_email(request, user)
        messages.info(
            request, _(
                "We have sent you an email to %(email)s "
                "so you can activate your account!") % {'email': form.get_email()})

        # TODO: email-less activation
        # if not settings.REGISTER_EMAIL_ACTIVATION_REQUIRED:
        # login(request, user)
        # return redirect(request.GET.get('next', reverse('spirit:user:update')))

        return redirect(reverse(settings.LOGIN_URL))
    return render(
        request=request,
        template_name='spirit/user/auth/register.html',
        context={'form': form})
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.