def custom_login(request, **kwargs):
    # Currently, Django 1.5 login view does not redirect somewhere if the user is logged in
    if request.user.is_authenticated:
        return redirect(request.GET.get('next', request.user.st.get_absolute_url()))

    if request.method == "POST" and request.is_limited():
        return redirect(request.get_full_path())

    return _login_view(request, authentication_form=LoginForm, **kwargs)
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.