added callbackRoute param to doAuth to allow alternative callback routes