Fix #248: Fix next param logic and move logic to Python.

By deciding whether to redirect the user to the next param URL or the
default URL in Python instead of JavaScript, we can rely on Django’s
is_safe_url logic.
If you're writing tests straight against this, then maybe it should no longer be private. Private methods/functions are for when things can stay in the black box.