Check for errors when getting access token.
Added multiple auth methods (for non-CORS resources), and made redirect
wotsit callable, not default.