AuthCore controllers now handle general client redirects

The AuthCore system (and default login_form template) now pass/persist a
full (local) url redirect target instead on only the hash part of the
url. The old 'hashpath' param is now ignored, and 'redirect' is used
instead, which is now the same in both login and logout contexts. This
allows accessing any kind of URL resource and logging in first, if
needed. The system already did this, just only for hashnav paths. Now it
doesn't care