In the `embed` case
* this should be the URL of the current page (`h.base_url() is the instance overview page)
* and written in the session (as you do)
* and I think it doesn't need to be written in the querystring variable (e.g. behind `register`, as it's in the session already - but I might be wrong, needs to be checked)

In the non-embed case,
* the `came_from` attribute in the session should be left alone (e.g. if you're coming from the login overlay with a validation error)
* if `came_from` isn't in the session yet, but available in the querystring (I'm not sure though whether this still exists in the code), it should be set in the session.