Generalized returnTo

The returnTo mechanism is now used in the general case where I try to do
something, but can't because I'm not logged in.  onUnauthorized() now
sets returnTo before sending you over to login, so it will generally do
the right thing and try to return to the page you were looking for.

This fixes a minor but annoying interaction bug that bites me
*constantly* while testing, so it'll be nice to have.