fixed bug with callback URL in oauth.js