Login drops the protected-page return path

[rissrice2105-agent]

Bug

Visiting /refer while signed out correctly redirects to /login?next=/refer, but LoginForm always routes a successful sign-in to /account. The intended destination is lost.

Reproduction

1. Sign out.
2. Open /refer.
3. Sign in successfully.

Expected: the browser returns to /refer.

Actual: the browser navigates to /account.

Proposed fix

Honor a validated internal next path after login and fall back to /account for missing, absolute, protocol-relative, or backslash-based destinations.