Pass-through successReturnToOrRedirect option

Another common option for passport-local - however, maybe we can abstract this in case other strategies need similar options (and POST verb support)?

Added `loopback 2.xz to peerDependencies.