returnTo not URL-encoded #13596

Value of /oauth/callback?returnTo= doesn't seem URL-encoded. This may give unexpected results when value is an URL that itself contains special characters, qurery params, etc.

Perhaps the fix can be applied here:

- redirect_uri: `${getAppRoot()}/oauth/callback?returnTo=${returnTo}`,,
+ redirect_uri: `${getAppRoot()}/oauth/callback?returnTo=${encodeURIComponent(returnTo)}`,

This needs to be verified.