AID-599: Redirect user back to URL when doing a POST

Should login failures return 200, even if it's an API call? What do you say, @ruudud?