diff --git a/app/controllers/auth.js b/app/controllers/auth.js
index 7dbe888..0b05fb1 100644
--- a/app/controllers/auth.js
+++ b/app/controllers/auth.js
@@ -152,10 +152,16 @@ class AuthController extends SiteController {
         return res.redirect('/welcome/login');
       }
       this.log.info('user logging in', { user: user.username });
-      req.login(user, (error) => {
+      req.login(user, async (error) => {
         if (error) {
           return next(error);
         }
+
+        // scrub login return URL from session
+        delete req.session.loginReturnTo;
+        await this.saveSession(req);
+
+        // redirect to whatever was wanted
         return res.redirect(redirectUri);
       });
     })(req, res, next);