Handle properly refusing when entering via twitter

According to https://dev.twitter.com/docs/application-permission-model#updates

> there is a "Return to App" URL on the Deny and Cancel screens that redirects the user to the oauth_callback url with a 'denied' parameter instead of oauth_token.