Check we have a proper url for the value "returnUrl".

Will not allow injection attacks