always decode returnTo before redirect

It turns out there are a couple places we do show the `returnTo` address, and to be sure we aren't carrying around potentially data, we'll continue to encode it as soon as we get it. So to fix this issue though, before redirecting, we'll always *de*code it, so it's back to the original value an RP passed.

fixes #3903