Fix 2 vulnerabilities in callback handling

[Arie]

Fix two vulnerabilities based on the work of the passport-steam node.js library.

1. Check for the correct ns, identity and claimed_id. See New vulnerability fix liamcurry/passport-steam#120 (comment) for how this was abused.
2. Check there aren't any extra query parameters in the callback URL. This was used to inject extra parameters containing unicode null bytes, allowing logging in with a steam id of the attacker's choosing. Based on Fix critical vulnerability: Add OpenID query parameter validation liamcurry/passport-steam#127