The authorization endpoint now returns a 200 on "oob" oauth_callbacks.

It does not make sense to return a `302` with `oob?oauth_token=...&oauth_verifier=...`.

Instead the endpoint should return a `200` with the data in the body. The implementer is responsible for presenting this data to the client. This also keeps the endpoint API consistent.