iframe oauth flow.

Follow on for #1437. Review this.
Good point.