store originally-requested path if auth required but not authorized; redirect to original path after auth