Don't just send the user to their profile on login if they were trying to visit a restricted page. Use [is_safe_url](https://docs.djangoproject.com/en/1.8/_modules/django/contrib/auth/views/) to prevent open redirection.
Don't just send the user to their profile on login if they were trying to visit a restricted page.
Use is_safe_url to prevent open redirection.