If the login page has the fe_group = -1 (hide at login) configuration set, the redirect given by return_urlparameter can not be executed. Probably it's because the page restriction is checked before the redirect takes place, which results in a 403 for the login page after a successful login. Setup example:
Startpage: slug = /startpage
Login: slug = /login, fe_group = -1 (hide@login)
Profile: slug = /profile, fe_group = -2 (show@login), extendToSubpages = true
Edit: slug = /profile/edit
Logout: slug = /profile/logout
The reason for this setup should be obvious: having only a "Login" button shown in the main-navigation for anonymous user, and after the login, a "Profile" button shows up instead with all restricted pages below it. Or is there a better way to solve such use-case?