Allow OAuth1 callback to specify query string parameters

They are then parsed and provided to underlying HTTP package. We have to parse them so that signing of requests works properly. In addition, nonce used in the request is stored in the response so that user can verify JWT payloads returned from the server.
Hrm... this doesn't look right to me. For a GET request, we don't necessarily want to wipe out the query parameters. (In fact, we probably don't want to.) Can we put this in a helper function instead and only use it where we are sure we want this behavior? (i.e. `prepareRequestToken` and `prepareAccessToken`)