backporting an auth fix (only extract referer url for login when the user is redirected to login)