Function parseAuthorizationCallback

Validates a redirect back from the authorization server and extracts the authorization code. Checks, in order:

1. Origin — the callback URL's origin must equal the registered redirect URI's origin. A page embedding this app (or a misconfigured relay) could otherwise hand a code intended for a different origin to this code path.
2. Provider error — error/error_description, per RFC 6749 §4.1.2.1.
3. state — must equal what this session generated (RFC 6749 §10.12). Checked before trusting code is even present, so a forged callback is rejected on the CSRF check rather than failing later for a more confusing reason.
4. code presence.