Allow auth-code timeout to be configurable

Some OAuth servers are super slow so the callback times out prior to receiving the auth code. Making the timeout configurable would be great. I'm happy to open a PR for this if it is an acceptable feature