Avoid POST pages when saving URL to return to after login #28

We currently save the current URL when performing a login operation. However, if the current request was anything other than a GET, it can't be returned to. In such a case, we should use the previous URL, determined from the referrer (provided it's on the same domain). Sending the user back to where they came from won't replay the POST (which we want), but will at least send them back to a working URL.