Allowed Callback URLs validation is incorrect

[hellein]

That’s fine, I guess, but this is clearly a bug.