Redirect to a default path if HTTP_REFERER is not set

Safari 9.0 does not yet honor the HTML5 origin-when-cross-origin mode, and it's possible load balancers/proxies strip the HTTP_REFERER from the request header. In these cases, default to some default path.

Closes #3122 (closed)

Closes https://github.com/gitlabhq/gitlabhq/issues/9731