XSS on www.mapbox.com/authorize

Description --- When you don't include the parameter __client_id__ in the request to the endpoint at https://www.mapbox.com/authorize/, the template __template-modal-unauthorized__ (included in the client code of the endpoint) is rendered with the value of the parameter __redirect_uri__ sent in the …

Code at https://www.mapbox.com/authorize/
<% if (obj.redirect) { %>
      <div class='fill-gray pad2y pad4x center'>
        <a href='<%= obj.redirect %>' class='button col12 close'>Back</a>
      </div>
<% } %>