Fix authorization under csrf protection

Since the authorization page was posting to window.location, the url was
absolute, and the external-xhr check was triggering.

I cannot believe this is how one parses a URL in javascript.
Merge pull request #267 from eve-val/fix-csrf-authorize

Fix authorization under csrf protection