api/tiktok: validate that redirected link is still tiktok