Stopped requiring authentication for hangout-url requests, added CORS headers on that resource, and fixed a bug. Callback is sort of working - I see the request on the server, but the browser claims it fails.