fixes #838 - remove login form action, and unified requestUrl (removed)
to "target" URL param which was also supported