Remove user-controlled return_to parameter

Despite steps taken in 52ebe7ecc5bf0ddcdf3ca0dc07e0160bec45767d, it is
possible for an attacker to construct a retrun_to parameter that would
redirect the user off-site. I can provide the details via email or in
campfire.

The session[:return_to] value does not seem to be similarly vulnerable.

The params[:return_to] parameter isn't actually used in the default
templates, and a search through the git history (to the best of my git
ability) shows that it never was. This means:

* it should be safe to remove
* it's unlikely any applications are exploitable.
* it's unlikely this change will cause incompatibilities.