Fix authorization under csrf protection

Since the authorization page was posting to window.location, the url was
absolute, and the external-xhr check was triggering.

I cannot believe this is how one parses a URL in javascript.