adds only_path: to sign-in redirect