back_url support after login using the cookie