auth: correct redirect url in oauth callback code