email notifications & query strings with authentication

I believe Atsu is right here - even so, maybe putting ```redirect_to``` last for sake of readability is a good idea?