A bunch of tests and the ability to specify the auth code as a parameter to the initializer

Previously there was no way to trigger the callback_phase internally without it coming from a request (meaning you can't do more complex authorization schemes. With a small change you can now call #callback_phase by passing the appropriate constructor params.

I also wrote an end-to-end test of #callback_phase which was sorely missing