This help article is just a notice saying that you can enter in multiple return urls, rather than specifying a wildcard, but since we're programmatically spinning up subdomains, this means I might have to drop salesforce support.
!!EDIT!! Actually, there is a {state} variable you can pass into the GET call to the authorize endpoint which will return to your redirectUrl. So instead of specifying a wildcard callback url, you can specify a centralized one and pass in a (url encoded) identifier and redirect the user back to their proper location. Kinda a hack, but working with salesforce always seems to be so.
Also, for logging in a user and getting access to their salesforce account via oauth, I think the flow is going to be:
GET:
https://\login.salesforce.com/services/oauth2/authorize?response_type=code&client_id={client_id}&redirect_uri={redirect_uri}&state={whatever_you_want_sent_to_the_redirect_url}
Which returns a GET code to your redirect Url, which then in turn is posted over to
POST:
https://\login.salesforce.com/services/oauth2/token
code: {access code you just received}
grant_type: 'authorization_code'
client_id: {from app config}
client_id: {from app config}
redirect_uri: {from app config}
However I cannot get my security settings to work so I always get an error, but it does seem that what I was asking is possible.
This just gets your oauth tokens which you can use to get the contact info (I'll post when I get past my authentication issue)
If I'm doing anything else wrong I'll update the answer.