rename came_from -> ret_url
define c.ret_url in base template

This has the benefit of having the validation in a single place
is_local_url js implementation