query_string was encoding `/`, but I think the `@login_required` character generates query params with `/` unencoded, so switching to this call signature and using `safe='/'`