Support redirecting to arbitrary URLs after login is succesful #29 (now it uses state without cookies nor session)