Replace /login history entry on success and redirect authenticated /login to /, with no-store headers to prevent caching.