Use Reply-Location header instead of overloading Location

This also enables new behavior when blind-POSTing to an occupied offer:
the redirect now contains all the same info as the equivalent GET.