[Security] Keep other query string parameters when switching users

Bug fix? 	yes
New feature? 	no
BC breaks? 	no
Deprecations? 	no
Tests pass? 	yes
Fixed tickets 	n/a
Doc PR 	n/a

When switching users, the whole query string gets dropped when redirecting after the switch.
I think only the switch user parameter should be dropped from the query string.

This PR implements that. I'm not sure whether using `parse_url()` and `http_build_query()` are the right way to do this.
I did not find the specific tests for switch user functionality, so I did not yet add a testcase for this PR.