Use $location.replace to avoid history spam from login redirects