Optionally avoid parsing callbackURL

Certain Google+ OAuth flows make use of a callbackURL of `postmessage`, which is really just a string token.  It should not be treated as a URL.  This change introduces a new config property that can be included in the call to `authenticate`: `parseCallbackURL`.  If this is present and has a value of `false`, then the value of `callbackURL` will be included AS IS into the OAuth request.

Usage looks something like this:

```javascript
    passport.authenticate('google', 
        { callbackURL: 'postmessage',
          parseCallbackURL: false }),
```

Please review/incorporate as desired.

Thanks,
--Doug