Can you make sure returnTo is URL encoded? (URLEncoder.encode I believe).