Allow any valid (per RFC 3986) scheme name in OAuth callback URLs

Changed the callback_url regex so that you can have custom schemes such
as myapp: or my-lovely-app: instead of just http and https. This should
help with mobile development where users can authorize with OSM in their
browser and are automatically redirected to the registered app.