Introduce callback to check redirect_uri

This gives the auth server a way to implement its own policy about `redirect_uri`s.