move url parameter to end of OAuth constructor, client_token and client_secret are more likely to be provided (without names). Conditionally convert callback and verifier to unicode. If omitted, unicode conversion sent literal u\None'.