According to the Single Responsibility Principle, each object should do the smallest possible useful thing. For Rails controllers, that thing is handling requests and rendering views with associated objects. So I would put that in a controller.
Devise has a great wiki on the subject of redirecting after a successful login.