The spec doesn't call for the authorize promise returning the authString...

I think perhaps what we should do instead is have testConnection return some kind of constant to indicate that authorization is required. The caller then calls authorize() which spawns the UI and stores the authorization token in the connector's memory. Then the caller, having received the authorized promise resolution, calls testConnection again, and the stored token is used.

Sound do-able?