login: harden checks for 'next_url'; never redirect to login.* after login success