Fix came_from to handle relative URLs in login form/handler

And we no longer need to prune the came_from URL to prevent arbitrary redirects, now that we're using route_path() rather than route_url() everywhere