Store the url in session and perform an interstitial redirect

This avoids leaking the session key.

The redirect code originally did this, then it changed.