Navigate top frame with no interaction, via same-site open redirect or XSS allowing redirect