defaultReturnUrl is used instead of returnUrl