Remove AuthCallback dependency and use authorization server.

- get auth code from the Location: header in the redirect when posting
  to authorize scopes
- use authorization endpoint to do the authorization steps and the token
  endpoint for the token steps