Optionally accept a "from" parameter in commence login. This allows logins with pure 302 redirects instead of existing javascript redirects. Will now default to the root URL if neither parameter provided.
No open redirect.

See https://www.owasp.org/index.php/Open_redirect