The function redirect() detects those URLs as relative URLs and checks with file_exists() if the file "xyz" exists if "app.php/xyz" is passed to it.
This obviously doesn't work and causes the redirect to always default to the current page, which is ucp.php during login. ucp.php then in return redirects to index.php because the user is obviously already logged in at this point.