Redirect away from POST

Returning OK from these POST endpoints leaves users open to replay attacks.

Those endpoints will now redirect.
Are we discarding all the cookies for our domain here, not just the authentication cookie? If so, why?