Allow omniauth callback route via GET in addition to POST

Some providers do this, e.g. Google via OpenID Connect.