11306d1e

By: Michael Lynch <git@mtlynch.io>

Test login redirect precedence for next

Confirm that login only trusts the URL query string for `next`.
This preserves the redirect contract when a POST body includes its own value.