move query string parsing out of index.html and into Browser.js
mostly-complete OAuth2 implementation