Rework return_path session key handling

- Add new IHandleSessions::pop() method
- Remove redirection from Authentication::setForUser()
- Add explicit return_path form parameter to Login::form()

src/Core/Session.php

@@ -44,6 +44,11 @@ class Session
 		return DI::session()->get($name, $defaults);
 	}
 
+	public static function pop($name, $defaults = null)
+	{
+		return DI::session()->pop($name, $defaults);
+	}
+
 	public static function set($name, $value)
 	{
 		DI::session()->set($name, $value);

src/Core/Session/Capability/IHandleSessions.php

@@ -54,6 +54,16 @@ interface IHandleSessions
 	 */
 	public function get(string $name, $defaults = null);
 
+	/**
+	 * Retrieves a value from the provided key if it exists and removes it from session
+	 *
+	 * @param string $name
+	 * @param mixed  $defaults
+	 *
+	 * @return mixed
+	 */
+	public function pop(string $name, $defaults = null);
+
 	/**
 	 * Sets a single session variable.
 	 * Overrides value of existing key.

src/Core/Session/Type/AbstractSession.php

@@ -52,6 +52,20 @@ class AbstractSession implements IHandleSessions
 		return $_SESSION[$name] ?? $defaults;
 	}
 
+	/**
+	 * {@inheritDoc}
+	 */
+	public function pop(string $name, $defaults = null)
+	{
+		$value = $defaults;
+		if ($this->exists($name)) {
+			$value = $this->get($name);
+			$this->remove($name);
+		}
+
+		return $value;
+	}
+
 	/**
 	 * {@inheritDoc}
 	 */