prevent error in post_login_form_to_signed_url

In some instances, when the `$parsed_url` doesn't have a `query`, the `post_login_form_to_signed_url()` function would emit a php notice and thus return an invalid result, which would then fail the signature checking process and thus the authentication flow would fail.

This prevents the "Someone may be trying to trick you..." notice to appear in the wrong context.

Discovered this bug while helping one of our API users debug an issue (see https://github.com/snarfed/bridgy/issues/161#issuecomment-45287830)
concat $url instead of overwriting it

props @justinshreve
Merge pull request #671 from jkudish/master

prevent error in post_login_form_to_signed_url