Correct signature for openid based strategy

The Google strategy is based on OpenID.  In this case, the verify callback gets called with the profile as the second argument (if the arity is > 2).  The accessToken and refreshToken args are relevant for OAuth based strategies.