Return to a specific OpenID endpoint so we can CSRF whitelist it

This avoids CSRF restrictions when the user is redirected back to us
from the OpenID provider.  Whitelisting a /NoAuth url is not currently
required as all NoAuth paths skip CSRF protection but doing so declares
our intent and provides a modicum of future-proofing should that
assumption change.