When I tested this and the return_to was not set (e.g. clicking the login link directly, instead of going there through authenticate_user!), the user would be redirected to some random Accounts page after login, since that was the referrer (they login in the Accounts site after all). Removing this made the user be redirected to the Exercises root instead.

Maybe there's a better way? But regardless, going to the referrer just seems wrong in this case.