v2 redirect now keeps the signed fields in the gateway payload, sets
submit_method to POST, and leaves PayURL empty, while v1 redirect still
returns a query-string PayURL. CreatePayment then returns a same-origin
/api/v1/payments/epay-redirect URL taken from the notify URL's scheme
and host, with the payment id and a random token in the query, and
stores that token on the payload; a zero payment id or a notify URL
without an http or https origin fails creation with a config error. GET
/api/v1/payments/epay-redirect sits on the callback rate-limit group and
is unauthenticated. It answers with an auto-submitting HTML form that
POSTs the stored fields to the stored gateway endpoint only when the
payment is a pending epay redirect, still within its expiry, not
superseded, and the query token matches the stored token by a
constant-time compare of SHA-256 digests; every other request is a 404
with no form.
Fixes#349
dujiao-next