Don't send URL in redirect body

If you put a CR in the redirect URL, the response splitting protection refuses to send the Location header, and the body is rendered in the browser; instant xss. It would not surprise me if some browsers ignore the Location header for less obviously broken URLs, so let's just remove the URL entirely.

hphp/runtime/base/server/transport.cpp

@@ -793,7 +793,7 @@ void Transport::redirect(const char *location, int code /* = 302 */,
                          const char *info) {
   addHeaderImpl("Location", location);
   setResponse(code, info);
-  sendStringLocked(location, code);
+  sendStringLocked("Moved", code);
 }
 
 void Transport::onFlushProgress(int writtenSize, int64_t delayUs) {