Check for empty code in calback

Prevent a redirect loop by checking for an empty `code` GET parameter
in the callback request.