OK, this is not the right way.

Without full URL parsing I cannot predict if the action is going to create the PrincipalException or not. There can be token-whitelisted portlet actions that customers want to trigger after login, not talking about portal actions.

The behavior we have in 6.2+ is the right one - correctly handle the exception when it occurs. I believe we need to backport this behavior to 6.1 and don't sanitize redirect.