Only handle OAuth callbacks to /oauth2callback (fixes #13)