Rather than put all of this logic in javascript, can we instead have the login view just return a destination in the response object? This will allow us to do some more sophisticated checks if needed (such as permission tests), rather than a simple string manipulation. 

In fact, it is entirely possible we are making this much more difficult than needed. 
According to this:
https://docs.djangoproject.com/en/1.5/topics/auth/default/#limiting-access-to-logged-in-users
This is provided functionality in Django 1.5. We may just need to do some manipulation to make sure it works with our custom User model.