title: UserService.createLoginURL creates the URL in such a way that the second and third parameters in the destinationURL are lost
body: <p>I have a simple Java application on GAE with authentication set to
  federated login.</p>
  
  <p>I have two JSP's</p>
  
  <p>home.jsp is a JSP that doesn't have security constraints
  mypage.jsp is a JSP that has security constraints as shown at the
  bottom.</p>
  
  <p>On home.jsp I create a login url using:</p>
  
  <pre><code>userService.createLoginURL("/mypage.jsp?p1=a&amp;p2=b&amp;p3=c", null,
  "gmail.com",  new HashSet&lt;String&gt;());
  </code></pre>
  
  <p>this results in creation of url that looks like this:</p>
  
  <p><a href="http://www.mydomain.com/_ah/login_redir?claimid=gmail.com&amp;continue=http://www.mydomain.com/mypage.jsp?p1=a&amp;p2=b&amp;p3=c" rel="nofollow">http://www.mydomain.com/_ah/login_redir?claimid=gmail.com&amp;continue=http://www.mydomain.com/mypage.jsp?p1=a&amp;p2=b&amp;p3=c</a></p>
  
  <p>Once the user clicks this url, he is directed to the google page for
  login. After the user logs in he is redirected to mypage.jsp, only p1
  is available, p2 and p3 are lost.</p>
  
  <pre><code>&lt;security-constraint&gt;
         &lt;web-resource-collection&gt;
                 &lt;web-resource-name&gt;mypage&lt;/web-resource-name&gt;
                 &lt;url-pattern&gt;/mypage.jsp&lt;/url-pattern&gt;
         &lt;/web-resource-collection&gt;
         &lt;auth-constraint&gt;
             &lt;role-name&gt;*&lt;/role-name&gt;
         &lt;/auth-constraint&gt;
  &lt;/security-constraint&gt;
  </code></pre>