Fix CAS callback path

While it didn't cause any issues it doesn't make any sense to have the CAS callback path under /oauth.