There have been no reported changes to the API, [officially for many years][1], ([unofficially since January][2]).

But, frankly that script's approach should have never worked.  OAuth credentials are sent to:  
    `https://stackapps.com/a/7936#access_token=y6rVASxxxxxxxxxRO2R9Bg))` (for example)

But this is immediately 302 redirected to:  
    `https://stackapps.com/questions/7935/bulk-flag-comments/7936#7936`

So the current script cannot see the access token.  <sup><sub>(Except maybe on a really bad network/system, but one shouldn't count on such things.)</sub></sup>

Anyway, You should **never OAuth redirect to a page that is not fully owned and controlled by yourself, and on your server -- unless it is the officially provided URL for client side OAuth.**<sup>&ddagger;</sup>

[For the Stack Exchange API, this URL is][3]: `https://stackoverflow.com/oauth/login_success`.

See [**this answer**][4] on Meta Stack Exchange for framework code and an example of using authentication with a userscript.

<br>

----------
<sup>&ddagger;</sup> Not only is that brittle (as you have discovered), it can also be a major security risk, depending on the page chosen.

  [1]: https://api.stackexchange.com/docs/change-log
  [2]: https://meta.stackexchange.com/search?tab=active&q=%5Bapi%5D%20API%20%5Bstatus-*%5D
  [3]: https://api.stackexchange.com/docs/authentication
  [4]: https://meta.stackexchange.com/a/293498/148310