chore(client): Whitelist allowed oauth parameters that can come from the URL.

* Add whitelist capabilities to Url.searchParams
* This is an effort to understand the OAuth flow better.
* List of parameters comes from https://github.com/mozilla/fxa-oauth-server/blob/master/docs/api.md#post-v1authorization
Damn. You caught me.