Prevent came_from to redirect to 403

This does a couple of things:

* Corrects URLs in login and register form (see #631 - which I first assumed the cause of the 403s)
* Prevents the javascript code to patch the clicked `href` into the `came_from` parameter if this could lead to a 403 (see @xi's comment in #631)
* Cleans up a javascript function
* Refactors some helper functions

Out of scope:

* A nicer 403 message (see @xi's comment in #631).
* This doesn't solve the same problem for non-javascript users, as we use a different method of determining `came_from` here. This shouldn't be too hard though: use `data-href` instead of `href` attribute in the overlay triggers, and use `/login?came_from` in the `href` directly (instead of being redirected there due to missing permissions).