move callback URL to config
fix download of boxes (which was broken since oauth implementation)