Clear return_to URL in session when signing out.

Otherwise you might get an unexpected start page on a client, where someone else got an *access denied* error in the previous session.