Fix links breaking when sessions expire.

- Do not require CSRF token to stash session URL.
- Perform actual redirect in click event handler.

This currently only works if you left-click the link - if you elect to open it in a new tab with middle / right click, no redirect happens.

#302