Don't rely on me in the callback URL

[aaronpk]

should get the me from the session to avoid being tricked into exchanging the auth code at some other server

[cweiske]

This breaks https://commentpara.de, which hands out different user URLs depending on their login.

You input https://commentpara.de/ as URL, and the auth endpoint returns https://commentpara.de/user/3.htm

[aaronpk]

@cweiske This is just about not using the me returned in the callback URL. Quill still uses the me returned from the POST request that gets an access token. It looks like commentpara.de is returning me=https://commentpara.de/ in the response but it should actually return the unique user URL for the user who logged in. cweiske/anoweco#3

[cweiske]

For reference: Taking "me" from the callback is not secure because the user could change/forge that.