title: Unprotected redirect not cured by only_path
body: <p>I have a Rails 4 application, and when I run Brakeman, it (rightly) identifies an unprotected redirect in my create action.  However, adding only_path: true (as in the <a href="http://railscasts.com/episodes/358-brakeman" rel="noreferrer">Brakeman Railscast</a>) does not cure the warning:</p>
  
  <pre><code>  def create
      refer_url = params[:referrer]
      @portfolio = current_user.portfolios.build(portfolio_params)
      if @portfolio.save
        redirect_to refer_url, notice: "Portfolio was successfully created.", only_path: true
      else
        render :new
      end
    end
  </code></pre>
  
  <p>Results in:</p>
  
  <pre><code>+SECURITY WARNINGS+
  
  +------------+-----------------------+---------+--------------+-----------------------------------------------------------------------------------------------------------------------&gt;&gt;
  | Confidence | Class                 | Method  | Warning Type | Message                                                                                                               &gt;&gt;
  +------------+-----------------------+---------+--------------+-----------------------------------------------------------------------------------------------------------------------&gt;&gt;
  | High       | PortfoliosController  | create  | Redirect     | Possible unprotected redirect near line 14: redirect_to(+params[:referrer]+, :notice =&gt; "Portfolio was successfully cr&gt;&gt;
  +------------+-----------------------+---------+--------------+-----------------------------------------------------------------------------------------------------------------------&gt;&gt;
  </code></pre>
  
  <p>Why might this be?  What risk is Brakeman still identifying?</p>