I don't think that will solve it because just sending the CMS page url does the same thing, if the page requires a role and the user is not authenticated it redirects to login and passes its own url as the return url. But after that once the user is signed in while he is redirected to the requested page, the basepage detects that he must change his password and redirects to the password reset page which doesn't know about the previous return url. 

I've just fixed this in my copy so that when we redirect to password reset page we pass the current requested url as the return url and now password reset will use this param and redirect as needed. I just tested the fix in my copy and it worked well, so this will be fixed in the next release.

Best,

Joe