The OAuth callback validator was overly aggressive. Desktop applications can use the localhost in order to listen for the response from the OAuth server. In addition, it may listen on a non-standard port. This updated code only verifies the scheme and host. It also adds a WP filter that allows localhost in the URL.
Merge branch 'remove-callback-restriction'

* remove-callback-restriction:
  The OAuth callback validator was overly aggressive. Desktop applications can use the localhost in order to listen for the response from the OAuth server. In addition, it may listen on a non-standard port. This updated code only verifies the scheme and host. It also adds a WP filter that allows localhost in the URL.