ALWAYS redirect back to CAS server in the event a user attemps to target an application and is not authorized. It was interesting that even the tests had an unnessecary step of clicking the 'here' link in the default device templates to get around this problem. In the event there is a infinite redirect loop, this needs terminated on the cas server and not the cas client.