In LoginFilter.doFilter (right at the end of the class), there is some inconsistent handling of os_destination. If os_destination is read from a session attribute, it has the context path prepended. If read from a request parameter, it assumes the caller prepended the context path.

For consistency with other relative paths (login.url etc), we should treat os_destination as context-relative. Ie, Seraph prepends the context path.