WIP: iframe oauth flow.

Follow on for #1437. Not fully ready for review, but feedback on the approach/RP API would be useful.
probably just use `'0 auto'` here since they're duplicated.