I may be being too fancy for my own good here, but let me know what you think, @robguthrie; I do so like my one-liners. 

The && clause returns false when the url is invalid or nil, which'll set the dashboard path (`false || dashboard_path`) If it's present and not in the list of invalids, then path is set to the session value.

Alternatively, could be:

    clear_stored_location if invalid_return_urls.include? session['user_return_to']
    path = session['user_return_to'] || dashboard_path
    clear_stored_location

Felt a little gross calling `clear_stored_location` twice in the same method.