support external registration callback for declines

- redirect to callback with ?result=declined
- also process review feedback from @snarfed

issue #240