Bring back the provider hints and add two which Withings actually needs (according to the Withings documentation - note that this still doesn't work properly). In particular, a hint to suppress adding oauth_verifier to queries since Withings apparently doesn't want it, and a hint to include any extra parameters which were received along with the authorization token and verifier in the callback URL.