redirectPath improvements

If there is no `session.redirectPath` then:
- allow `?redirectPath` to be defined and used on `GET /auth/heroku`
- or, set `redirectPath` to original referer url

This is helpful for client side applications that would like to explicitly specify where a user should return after authentication