Allow end-of-OAuth redirect URLs to be 127.0.0.1.

We were being too restrictive about validating our redirect at the end
of the OAuth redirect flow: 127.0.0.1 is okay even if ROOT_URL is
localhost.