Fixed invalidated payload

Figured out that `wp_sanitize_redirect` was invalidating the payload (which is why I had a redirect back to `/session/sso`). This code is a little better since now the user will be sent to the Discourse `return_path` if they were not originally logged in to WordPress.

(I'm now just awaiting logout SSO functionality to be added and this will be pretty tight!)