store no information in the redirect URL

Some providers need an exact matching redirect URL configured (Google)
so we can not keep any dynamic info in the URL. Instead we store it in
the user's session.
Google now works