Correction: Salesforce does not require SSL if the callback URL is localhost