tom: add support for dynamic returnUrl and realms