Login security improvements

- Prevent use of GET vars in login controller/processor
- Restrict returnUrl in login processor to url of login context

(cherry picked from commit 9c2a9c5608cc5c1e319ba4ec5fc9e3aea59358df)

Conflicts:
	core/docs/changelog.txt
	core/model/modx/modmanagerresponse.class.php