fix(oauth): referrer -> returnUrl