Returning the Content-Location header when getting an access token.

This is useful for some providers who return the authenticated user's
URL in the `Content-Location` header, and do not provide any other way of
finding out who you're authenticated as.

I considered simply returning all the headers, since someone _might_ want access to other headers in the future... But that seemed like exposing too much. I dunno.