Revision "a" of OAuth 1.0 mandates the presence of "oauth_callback"
parameter.
Usually libraries appends an "oob" (Out of Band) oauth_callback if you
don't provide a valid callback url, and don't specify that you don't
want "OAuth 1.0a".
But apparently our library of choice for OAuth (liboauth) does not do
this, though the code is in library but commented out.
src/oauth.c:675-680 (as in HEAD, and 0.9.0 tarball):