fixed Login LoginUrl so it doesn't lowercase the returnUrl (it would have modified any parameters that were case sensitive, like encrypted data).  It looks like it was just lowercased to help figure out if it contained an account related route, so I rewrote it to keep doing that, but without modifying the returnUrl case