Redirects now determined by a white list of request controllers and verbs

See title. White listing is a better solution because it's less likely that new features will secretly re-introduce redirect bugs.

Some tests were deleted because of the different / simpler implementation. (And also because those tests where just bad -- my fault.)