use omniauth failure endpoint on failure (missing code)

When the user denies the permission to access their data the callback will be called without a code and with an error instead.

Currently this will result in an exception when the strategy tries to read the missing code parameter.
This patch catches that condition and calls fail! which delegates the request to the OmniAuth failure endpoint which can be used by applications to render a proper error page.