for oauth based logins, let the callback be based on the current request because it's not a problem and the user may be visiting from a URL different than SITE_ROOT_URL, such as right now as I'm migrating GovTrack to https:.