fix: return_to URL in maybeInitiate2FA

Checklist

[ ] I have read the contributing guidelines and signed the CLA.
[ ] I have referenced an issue containing the design document if my change introduces a new feature.
[ ] I have read the security policy.
[ ] I confirm that this pull request does not address a security vulnerability. If this pull request addresses a security vulnerability, I confirm that I got approval (please contact security@ory.sh) from the maintainers to push the changes.
[ ] I have added tests that prove my fix is effective or that my feature works.
[ ] I have added the necessary documentation within the code base (if appropriate).