Get rid of manual callbackURLs, they're ridden with problems

It appears the API rejects some URLs even when they're not different, and then doesn't honor it anyways.
Only allow application/json from the access_token API
Complete +authorizeWithServerUsingWebBrowser:… after 1 token
Don't error in -enqueueUserRequest… if we're authed