don't add parameters to return URL, and use same return-url mechanism on verification as we do on init