The OAuth callback validator was overly aggressive. Desktop applications...

... can use the localhost in order to listen for the response from the OAuth server. In addition, it may listen on a non-standard port. This updated code only verifies the scheme and host. It also adds a WP filter that allows localhost in the URL.