Re-signing in to same user? Don't log out
Improve bounce-through-logout.

Don't expose fields through URLs; we get an error due to too-big
headers in the redirect. Instead store them in the session.