Pedantic cleanup of callback URIs.

Currently, the callback in the oob case includes a `nonce` for state; we don't
need this in that case, so drop it. (It makes these URIs stable, which will be
helpful if one of us writes tests for them.)
Merge pull request #46 from craigcitro/nit

Do a little over-pedantic URL cleanup.