Allowing returnURL option for the new password endpoints