fixed login redirect when returnurl is empty