Rethink how post redirects work

[gbp]

The underlying cause of #4160 was the post redirect feature.

A PostRedirect instance is created after a logged out user composes a request, previews, and clicks "Send and publish request". This means if the user goes to /new?post_redirect=1 a duplicate request would be created - if not caught by InfoRequest.find_existing.

Perhaps we should rethink how post redirects work. Ideas:

• Destroy post redirects once used
• Remove post redirect token from session once used

Also which other website replicates POST requests after login, we should also consider:

• Removing feature completely
• Switching to GET redirects only

Both removing and switching to GET redirects would allow us to CRUDify the requests controller... currently we're limited and have to handle all new/preview/create states in the one new controller action. Ideally we would be able to split these up into CRUD actions but can't at present while retaining compatibility with the current post redirect feature.