TODO move to DeviseSessions controller and figure out how to set headers after a redirect. Or even, if this is the right approach