Ignore query and fragment in validating allowed callback URLs

[louischan-oursky]

The validation is doing exact string match. It is more useful if the provided callback URL is first with its query and fragment removed.

For example if http://localhost:3001/auth is allowed then the callback URL http://localhost:3001/auth?a=b should be allowed.