oidc: remove authcallback.html from history

this way atleast token goes away from history. part of #844

dashboard/authcallback.html

@@ -1,17 +1,18 @@
 <script>
 
-var tmp = window.location.hash.slice(1).split('&');
+const tmp = window.location.hash.slice(1).split('&');
 
 // FIXME: implicit flow (response_type=code token) results in access_token query param. this is not secure
 tmp.forEach(function (pair) {
     if (pair.indexOf('access_token=') === 0) localStorage.token = pair.split('=')[1];
 });
 
-var redirectTo = '/';
+const redirectTo = '/';
 if (localStorage.getItem('redirectToHash')) {
     redirectTo += localStorage.getItem('redirectToHash');
     localStorage.removeItem('redirectToHash');
 }
-window.location.href = redirectTo;
+
+window.location.replace(redirectTo); // this removes us from history
 
 </script>