always decode returnTo before redirect

fixes #3903