add test for login redirecting to home_url
explicitly allow home path in back_url