Check we have a proper url for the value "returnUrl".

Will not allow injection attacks
I would merge `domainRegExp ` into `validDomain `