Allow setting came_from value with url parameter

The current behaviour is to set `came_from` to the value of the current
url which works well when returning 403 pages. For non-logged in users I
would prefer to redirect them to the login page (while keeping the 403
response for logged in users) and so would like to be able to set a url
parameter which indicates which page to return to.

    @forbidden_view_config(renderer='403'.jinja2')
    def forbidden(request):
        if authenticated_userid(request):
            request.response.status = 403
            return {}
        url = request.route_url('login', _query={'came_from': request.path})
        return HTTPSeeOther(url)

With the change to `utils.js` the above works alongside the current
implementation.

I added an additional setting so that a user can define what querystring
parameter to use although I default to `came_from`. Feel free to change the
setting name as I'm not completely happy with it.