always decode returnTo before redirect

fixes #3903
Merge pull request #3906 from seanmonstar/dont-encode-returnto

always decode returnTo before redirect