Don't Unescape redirect_to cookie value

[mrsdizzie]

redirect_to holds a value that we want to redirect back to after login. This value can be a path with intentionally escaped values and we should not unescape it.

I'd guess the original logic here is that all cookies are escaped and so you usually unescape them before using the values. However, getCookie already does unescaping so we are doing it twice.
To see this bad behavior: log out of try.gitea.io then visit this URL

https://try.gitea.io/mrsdizzie/parsing-errors/src/branch/master/%23testme

And click sign in from there. The path remains escaped until the final redirect after successful sign in at which point it redirects to the incorrect https://try.gitea.io/mrsdizzie/parsing-errors/src/branch/master/#testme which isn't rendered properly and just shows the main repo page

That is because getCookie returns the unescaped mrsdizzie/parsing-errors/src/branch/master/%23testme and then the 2nd call to url.QueryUnescape turns that into mrsdizzie/parsing-errors/src/branch/master#testme

For reference, I bet things are this way because they predate the following change:
go-macaron/macaron@b7c39df#diff-05a3aa0ab9e5687ff167e0ef3ae4c5a6R300

Fixes #4475

[codecov-io]

Codecov Report

❗ No coverage uploaded for pull request base (master@6d345e0). Click here to learn what that means.
The diff coverage is 20%.

@@            Coverage Diff            @@
##             master    #6399   +/-   ##
=========================================
  Coverage          ?   38.85%           
=========================================
  Files             ?      365           
  Lines             ?    51389           
  Branches          ?        0           
=========================================
  Hits              ?    19965           
  Misses            ?    28553           
  Partials          ?     2871

Impacted Files	Coverage Δ
routers/user/auth_openid.go	0% <0%> (ø)
routers/user/auth.go	13.07% <25%> (ø)

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 6d345e0...80c63cb. Read the comment docs.

[techknowlogick]

@mrsdizzie thanks for PR 😃 please backport to release/v1.8 branch.