Document :callback_params in README or similar

[asummers]

Turns out this is a whitelist that defaults to []. We just got bit pretty hard by this behavior being hidden, so it's worth calling out in the docs. Effectively we had a bunch of plugs all acting on the presence of query params and were very confused why they never seemed to actually trip. This whitelist behavior was very unexpected.

Seems to have been added quite a while back in #45

Curious what the utility for that being a whitelist is. I wonder if it should only whitelist if :callback_params is nonzero length or something like that?

Additionally, and perhaps this is a bug to file with the individual strategies but things like https://github.com/ueberauth/ueberauth_google/blob/88b9ae851ffda0d34e991ee85e84a0803f7448d0/lib/ueberauth/strategy/google.ex#L15 seem to be just ignoring these options and leaving them at the door, even after adding to the callback params .

Facebook seems to maybe be handling them, albeit under a different option name? https://github.com/ueberauth/ueberauth_facebook/blob/2b31d99c35852327aa5b509128f0f9f7f689c774/lib/ueberauth/strategy/facebook.ex#L25

I guess as a followup to this: if I want a param to my request pipeline, (such as for e.g. setting a cookie for a user), what is the way to do that, Ueberauth-wide?

[Hajto]

Is this still valid? I tried combing through codebase looking for phrase "callback_params", but I could not find anything.