Login redirect_to

Don't just send the user to their profile on login if they were trying to visit a restricted page.

Use [is_safe_url](https://docs.djangoproject.com/en/1.8/_modules/django/contrib/auth/views/) to prevent open redirection.
