fix return_to uri
use json cookie serializer