Enforce 1.0a callback param handling

The 1.0a specification requires that oauth_callback is included in the
request to /initiate. It also requires that oauth_callback_confirmed be
returned. (see RFC5849, section 2.1)

Change-Id: I144ef583dcabf2c7ac89f3f7d21bc36a64107b1f