improved logic to select returnUrl, in order: CWebUser::returnUrl, UserModule::returnUrl, '/'