oauth: let type=2 use 'oob' as callback