Cleaned up oauth2.js a lot, added asserts.