Default unauthorized handler can redirect to the request.referrer header

[jwag956]

Make sure this isn't a form of open redirect vulnerability - as described in https://sec.okta.com/articles/2021/02/stealing-oauth-tokens-open-redirects

Not sure there is any reason we should do this (been this way for a long time).