Preserve query parameters in _return_to for redirect.

Storing just request.path drops the query string which makes two factory
authentication less useful when the guarded page needs those parameters.

This brings the two factor authentication redirect behavior in line with
devise's.