added moz box shadow
unset return_url session to null if not specified in login function of outsider controller