Using custom provider with express enforces use of callback which in turn exposes access_token to the client 
Hey,

First of all, thanks for this great project!

I am using a custom oauth2 provider with express and I need to get the user info after the user has authorized a login. The way I found to do that is using the `callback` url which is called on `step3` in you're codebase. I've added a new endpoint that handles this `callback` with the `access_token`.
This is using redirect so the client gets the last `access_token` provided by my oauth2 service.
I may be wrong here but that seems a bit risky isn't it?

If so, is there a way to avoid the last redirect and allow for a simple callback that will handle the `access_token`?

If not, will you consider a PR of this sort?

Thanks again for any help and for this awesome library.

Cheers!