package MyApp;
use Dancer2;
use Dancer2::Plugin::DBIC;
use Dancer2::Plugin::Auth::Extensible;

our $VERSION = '0.1';

get '/test' => require_login sub {
    my $user = logged_in_user;
    return "Hi there, $user->{username}";
};

true;
[download]

appname: "MyApp"

layout: "main"

charset: "UTF-8"

template: template_toolkit
engines:
  template:
    template_toolkit:
      start_tag: '<%'
      end_tag:   '%>'
      PLUGIN_BASE: 'Template::Plugin::Pagination'

  session:
    DBIC:
      dsn: dbi:Pg:dbname=my_app
      schema_class: MyApp::Schema
      user: starman
      password: *****

plugins:
  DBIC:
    default:
      dsn: dbi:Pg:dbname=my_app
      schema_class: MyApp::Schema
      user: starman
      password: *****
      options:
        AutoCommit: 1
        AutoInactiveDestroy: 1
        PrintError: 0
        RaiseError: 1

  Auth::Extensible:
    realms:
      users:
        provider: 'DBIC'
        users_resultset: 'User'
        roles_resultset: 'Role'
        user_roles_resultset: 'UserRole'
[download]

When I navigate to /test, I get the login page.
When I enter an invalid username and password, I get the error "LOGIN FAILED" message.
When I enter a correct username and password, the login page appears to refresh, with the URL changed - each time the return_url query string is prefixed withan extra %25%2F. Eg, after a couple of loads, it looks like this:

/login?return_url=%2F%252F%252Ftest

I guess I have 2 questions - (1) Why isn't it now displaying the /test route, and (2) Is there anyway I can set up my config so I don't have to repeat the DBIC login data.

I've been going round in circles on this all day. It's probably a stupid typo somewhere. Any ideas?