do not add middleware on `callback` paths for every provider

[benkroeger]

Not all providers require a callback path.
This pattern is mostly implemented by OAuth schemes and e.g. not required when using a local or ldap provider