sanitize redirect; allow gist modules to bypass authentication in which case login.R has to act like login_successful.R and generate user/token pair
gitgist: declare the we bypass auth