added support for target uri parameter in third party issuer (or other custom issuer that sets the right flag on return), closes #539