- Add `next` field to LoginForm model for preserving post-login redirect target
- Implement `safe_next` utility to validate redirect URLs and prevent open redirect vulnerabilities
- Update login page handler to accept and pass `next` query parameter
- Add hidden `next` input to login form template for POST submission
- Modify `require_user` to redirect to `/auth/login` instead of root
- Add `Http.toLogin()` static method in JS for client-side redirect with current URL encoded
- Update CommentManager to redirect unauthenticated reply attempts to login
- Fix comment creation redirect to use `comment_url` instead of generic `redirect_url`
retoor
66d91407f5