[1.6.x] Prevented reverse() from generating URLs pointing to other hosts.

      This is a security fix. Disclosure following shortly.