Hrrrmm.. this method is a bit stinky.

What can we do to clean it up?
I recommend leaving it as:

session['user_return_to'] = request.env['HTTP_REFERER'] if request.env['HTTP_REFERER'].present?

and then filtering/ignoring any bad urls at the redirect_after_sign_in method