OAuth callback

Destination for the test OAuth flow. Captures the code + state from the URL and (optionally) redeems them for an access token via POST /token.