iframe oauth flow.

Follow on for #1437. Review this.
We will need something I suppose. @johngruen?