I hacked up a solution to call a function in a module.. that returns _SERVER['HTTP_REFERER'] which i put into the UserRedirect hidden field... this is really hackish and I would prefer a proper solution but going through the ezpublish code is too daunting.
I have some vague idea that it has to do with lib/ezutils/ezuri.php and perhaps even kernel/user/login.php but I can't find where the layout/set URI part is stored.
Maybe this was fixed after 3.5.0? Can someone backport the necessary changes?