Remove dead ?redirect OAuth flow.

This code has never worked without some fairly serious client-side
surgery, and it now especially doesn't work because it doesn't
communicate the credentialSecret back to the app. Rather than leave an
untested, unQA-ed code path in core, apps that are using the ?redirect
flow can just override `OAuth._endOfLoginResponse` to do the redirect
themselves.