redirect_to parameter for auth.logout can default to referer