use session for storing return_to value so devise'll do the redirect