Fixed [most of] the returned `url` in the auth callback. Not been given a `code`, so got to figure out what's happening here...