Pure-browser OAuth for CORS-supporting sites like OpenStreetMap