Handle login redirects via Referer not ?next param.

There's a lot going on in this branch... I didn't do a good job of keeping it very clean.

But basicaly this redoes the way we handle redirects after logging in to use Referer header rather than blindly accept `?next` param (which can be a security problem).

There's some tweaks to tests which are related-ish to the main problem of not being able to log in from a non-index page in tests. That problem isn't solved yet.