Allow 'postmessage' callbackURL

Fixes jaredhanson/passport-google-oauth#21