There are tests that cover:
* picking the correct 'next' value from the requests
* that `_clean_next_url` doesn't allow open redirects
* that you can't be redirected in a loop for verify_browserid, etc
?