Determine post-login redirect route entirely in backend

Login flow now determines redirect route server-side instead of trusting frontend logic.