When validating callback only the scheme and host are checked. In addition, a callback to allow 127.0.0.1 has been added. This allows applications to listen for an OAuth response on the localhost using a non-standard port (e.g. 127.0.0.1:9999).