While it didn't cause any issues it doesn't make any sense to have the CAS callback path under /oauth.
/oauth