Bugfix: after redirect, 'referer' header and page location should reflect the final URL, not the requested URL

Per Assaf's request, this is a repackaging of https://github.com/assaf/zombie/pull/432.

The added tests mimic the behavior of the Facebook JS client during OAuth login.  These tests fail without the bugfix and pass after the bugfix.

Lack of this bugfix is 100% blocking to simulating Facebook OAuth login to a website like StackOverflow or Wavii.com.

<!---
@huboard:{"order":364.0}
-->