Call res.redirect after user's handler code for login callback

[denysoblohin-okta]

Internal ref: OKTA-306438
Resolves okta/okta-oidc-js#340
Overseedes okta/okta-oidc-js#805

This PR improves case when user defines routes.loginCallback.handler
Description of this function in readme:

A function that is called after a successful authentication callback, but before the final redirect within your application. Useful for requirements such as conditional post-authentication redirects, or sending data to logging systems.

const oidc = new ExpressOIDC({
  // ...
  routes: {
    loginCallback: {
      handler: (req, res, next) => {
        // Perform custom logic before final redirect, then call next()
      },
    },

Current behavior

The developer needs to manually call res.redirect() in handler.
This requirement is not explicitly covered in readme and can lead to confusion (see okta/okta-oidc-js#340)
However, it can be useful to give developer the power to manually set redirect path after authentication.
For example, developer can use req.userContext.userinfo.locale

New behavior

If developer did not call res.redirect() in handler, it will be called automatically with correct value (routes.loginCallback.afterCallback) in next().
Otherwise, if developer have manually called res.redirect() with the value he needs, next() will do nothing.

[shuowu]

what's the res._headerSent? looks like a private field, should the middleware depend on it?

[denysoblohin-okta]

Changed to writableEnded
expressjs/express#743

[oleksandrpravosudko-okta]

nit: express v4 seems to have a public accessor for headersSent

[shuowu]

If that's the case, we probably should be able to keep it.
https://github.com/okta/okta-oidc-middleware/blob/master/package.json#L44