Correct verb (GET not POST) for OAuth callback

Signed-off-by: Alex Coles <alex@alexbcoles.com>