oauth: blindly trust user-supplied redirect URI when localhost in dev mode