Added redirect to OAuth2 callback on failure.

This adds a `denied=1` query string parameter to indicate failure.