Use !String.isEmpty() instead of length() != 0
Force the return URL to be a string.

We may have had problems with the StringBuilder not working when we
attempt to get it out of the session. The safe option is to convert it
to a String before it goes into the session.