Wow, I can't believe b2g lets this happen.

In the logcat, gecko throws a `CheckSameOriginError`:

```
E/GeckoConsole( 2718): Security Error: Content at https://eyedee.me/ may not load data from https://all-together-now.personatest.org/sign_in#AUTH_RETURN.
```

but it goes through with it anyway!

As Ian has pointed out, this redirect bug may be involved: https://bugzilla.mozilla.org/show_bug.cgi?id=456957.