Fix incorrect HTTP referer on hard loads

Instead of calling ``location.replace()`` in ``locationReplace``, call ``history.back()`` and then ``location.assign()``. This means the new page will be loaded with the correct HTTP referer – the previous page's URL.

``onPjaxPopstate()`` shouldn't do anything when we call ``history.back()``, because the popped state will be equal to ``pjax.state``.