Add local callback url.
Found the source of our mystery 500 that some users were reporting.

If you had revoked access to the app, and re-gave access, you had
a new access token. But username was unique. So everything blew up
because there was already an instance of your username in the db.

This sets the token to be unique (and fixes the type). We can still
go in and clean up the old row, but right now it's not hurting
anything.
Merge remote-tracking branch 'upstream/master'