an origin location can be passed to login() to redirect to after authentication