[tomblomfield]

Yes - you're absolutely right. We perhaps could have made this trade-off more explicit.

We didn't want the Policy object to know about the redirect paths, so we opted to cut down the number of responses available - we simply redirect_to :back by default, but this can be configured in the controller.