fix jwt return_to