save originally requested url in session so that we redirect back to it after auth