Hacky workaround for bug in `browser-module-sandbox`

browser-module-sandbox un-sets window.XMHttpRequest
Verify OAuth request does not return "undefined" string as token