Thanks to Andy Gup for these updates -

Index.php:
added error handling around decoding the oath cookie. Some php setups don't like the escapes and return null. Any developers adopting this code will appreciate the headaches this little bit o' code shaves away.
Added "validate" capability to verify credentials from client app.
Added delete oath cookie capability so that client app can be a good citizen and allow full/secure logout capabilities.

Callback.php:
Provide error handling around getAccessToken().
Built in a credentials verification sequence. This is a best practice to catch verifications errors up front by the end user. For convenience, I simply implemented this as a separate HTTP request rather than doing it in parallel and re-writing the CURL request handlers.