better redirecting security

-redirects from exam page (so that user cant jsut remove "resume" param
from url)
-checks that the exam being resumed is the one that is in progress in
the database