When attempting to submit a form after the session has timed out (due to the auth token being deleted, for example), the redirect for logout logic will attempt to use the submitted page url to redirect to after login.  However, some common form POST urls have no GET equivalent, which causes the user to get sent to a non-existent page.

The logout logic should adjust the "then" parameter to ensure that the url is reachable via GET.  We probably don't want to get too complex (i.e. store the post as a cookie..), but we need to ensure the user can return to their page.