Returning the Content-Location header when getting an access token.

This is useful for some providers who return the authenticated user's
URL in the Content-Location header, and do not provide any other way of
finding out who you're authenticated as.