moved oauth2 callback under federation/HRD routes

this way OAuth doesn't need to be enabled for using "OAuth2 logins" with
HRD