What happens if "returnUrl" is null?  It looks like it isn't required as a RequestParam.  It would make sense for the controller to have a default returnUrl that it uses if the passed in value is empty.