Don't allow re-authorization of authorized tokens
Handle empty callbacks correctly
Use correct message for verification token UI
Store user as part of token
Simplify return from handle_callback_redirect
Ensure we have default parameters for request tokens