Fix return-auth to insert URLs