This ensures that third party logins, whose callback is processed by the users controller, go to the right place.
Certain controller methods are shared with oauth-based logins, and these have been moved to a concern.