generalized provider and consumer callback urls
failing to handle case of authenticated && !req.isAuthenticated