Force redirect headers to use absolute URLs as per spec (though

browsers seem to accept relative ones); escape the page name
on the login cookie check.