Fixed verify_request_token_request in OAuth1 server

* it now calls verify_request with require_callback=True
* added docstring about oob callback
* added test demonstrating use case

Should fix #107.

Also, I noticed tests for (invalid) callback request are sending also secrets. Is there any point to do so?