make it work for real.  Use redirectcallback & redirectargs explicitly in _authorize