By: Michael Lynch <git@mtlynch.io>
Test login redirect precedence for next Confirm that login only trusts the URL query string for `next`. This preserves the redirect contract when a POST body includes its own value.