GitHub OAuth redirect_uri is built from window.location without encoding #631

Surfaced by review on #629, but pre-existing and unrelated to that change, so filing separately.

Problem

Every theme's login.html builds the authorize URL like this:

"https://github.com/login/oauth/authorize?client_id=" + clientID + "&redirect_uri=" + window.location

window.location is concatenated raw. When the login page carries query parameters — and it does, /login?next=/admin/settings is the normal path since #623 — the result is:

...&redirect_uri=http://site/login?next=/admin/settings

Everything after the first unescaped & in the redirect URI would be read by GitHub as a further authorize parameter. A next value containing & mangles the URL outright, and redirect_uri is supposed to match the registered callback anyway, so the query string may fail GitHub's validation regardless.

Fix

Encode it, and probably strip the query rather than round-tripping it:

var redirect = location.origin + location.pathname;
... "&redirect_uri=" + encodeURIComponent(redirect)

next already survives separately — it is read from the query string on the way back in and validated server-side by SafeNext.

Affects

login.html in goblog's default theme and all three external themes, which each carry their own copy.

Testing note

This needs checking against a real GitHub OAuth app, including what the registered callback URL is set to, which is why it should not ride along in an unrelated PR.