Add the iframe channel, use the iframe channel if iframed.

* Add a close button in the content.
* Start the shell of a CancelButtonView.
* allow /oauth/signin & /oauth/signup to be framed.
* The iframe does an ack/nack with the parent window to determine origin, only whitelisted origins can be iframed.
* Non-whitelisted origins are sent to the `/illegal_iframe` endpoint.
* Start on an OAuth RP include.js with a callback based API.
* Add a check in env-test to determine whether the user is in an iframe.
* Hook up the close button if iframed.