refactored to clarify and simplify what happens regarding redirection when somebody successfully logs in, and whether it should return to the previous location of an unauthorized item