don't set location until after redirecting