fixed up the sessions controller so it redirects to redirected URL, or to referred URL