OAuth1 doesn't have anything like the state parameter, and I overlooked that we need to shove one in there somewhere. Append it to the callback URI. This functions like state in OAuth2.
Without this, an attacker can trick a user into logging into Phabricator with an account the attacker controls.