title: PayPal button return url usage
body: <p>I've got a PayPal html button on my site which should return back to my website with data. My understanding is that there's a return url (with a return method) and a notify url which can do this. The notify url requires an IPN listener which seems like it does a verification check, which is good. I'm not seeing any such verification check for the return url, but it seems like I would want to update the return url based on the result from a verification check in most cases (eg whether the payment was successful). Moreover, I need to know PayPal actually requested the return url to update the db, otherwise this seems to open the door to csrf attacks via return url.</p>
  
  <p>I'm new to PayPal buttons, but I've not seen anything about using notify url and return url together. So what should I being doing in order to resolve these concerns with the return url?</p>