login/out: Close phishing hole

If someone passed a ?done=//phishing.com/site as the param, you'd still
end up being redirected somewhere awful, because of how // is
interpreted in url resolution.

    > u = '//phishing.com/site'
    '//phishing.com/site'
    > url.parse(u).pathname
    '//phishing.com/site'
    > url.resolve('https://www.npmjs.org/login', url.parse(u).pathname)
    'https://phishing.com/site'
    > url.resolveObject('https://www.npmjs.org/login', u).pathname
    '/site'

Resolve the object first against a fully qualified domain name, and then
take the resulting pathname.