Desktop applications only support the oauth_callback value 'oob'