OAuth redirect flow

See the spec for details: https://meteor.hackpad.com/OAuth-redirect-flow-spec-PeziTcaNPDP

Not implemented at this point is a mechanism for reporting login
success or failure back to the code which initiated the login, as the
anonymous callback API currently supported by
[Meteor.loginWithExternalService](http://docs.meteor.com/#meteor_loginwithexternalservice)
doesn't survive having the application reloaded after the redirect.

`accounts-oauth/oauth_client.js` has a placeholder `redirectComplete`
which is where the login ends up, which for now just debug prints the
login success or failure.

Untested with Weibo, as I wasn't able to get my application configured
correctly.

Fixes the Meetup account login, as Meetup now requires using
"https://api.meetup.com/2/members" instead of
"https://secure.meetup.com/2/members".

After email discussion we decided to encode the login style in the
OAuth state parameter instead of using separate redirect URI's with
`?close` and `?redirect` parameters, which would have required
entering both redirect URI's with strict providers such as Google, and
might not be supported by providers which only allow one redirect URI
to be specified.

The `?close` parameter is now unneeded and could be dropped to
simplify the login service configuration, but we'd need to support
login providers which have been already configured with the `?close`
parameter.
	
In accounts-base (localstorage_token.js), when we autologin on page load, we are slightly more tricky about reducing page flicker, doing the login initially as the package loads and not waiting for Meteor.startup to fire, and calling Accounts.connection.setUserId to be optimistic:

```
// On startup, optimistically present us as logged in while the
// request is in flight. This reduces page flicker on startup.
var userId = storedUserId();
userId && Accounts.connection.setUserId(userId);
Meteor.loginWithToken(token, function (err) {
  if (err) {
    Meteor._debug("Error logging in with token: " + err);
    makeClientLoggedOut();
  }
});
```

We should probably do something similar here. Maybe we should even factor it out into Accounts.logInOnPageLoad(userId, loginFunction) or something.