Movielogr - Track What You Watch

redirect() returns a separate RedirectResponse, so cookies set on the shared response during the request were dropped. When autologin fired on a search POST, the rotated key never reached the browser, and the next autologin attempt failed and logged the user out.

• Add global RedirectCookiesFilter to carry shared-response cookies onto redirect responses
• Switch search forms to GET; search is read-only and no longer needs a CSRF token, which removes blank 403 pages from stale tokens
• Bump version to 4.0.2