Lots of cleanup. This version is still not ideal, but it works end-to-end: sign in all the way through an OAuth-secured REST call across CORS