Use localhost:8537 as the CANONICAL_HOST after all

It turns out that when OAuth returns you to 127.0.0.1, if we have
CANONICAL_HOST set then you can be redirected--querystring intact--back
to localhost, with the result that the signing in works transparently.