Move from using redirect() to raw Location: header.
This allows custom URL schemes if required.
Merge remote-tracking branch 'richsage/oauth-redirection-change'