fix production callback url
remove heroku plugins
fix shiroOAuth funny targetUri behavior