Should probably say "callback must be an absolute URL"