Fix navigation
The fact that we're controlling state server-side via the session breaks user navigation (back/forward buttons) and it's not very user-friendly. We should move states to different URIs and switch to the standard model of redirect-on-valid-submit (possibly keeping session control as well, to validate progression).