Fall back to URL param auth if localStorage fails

It varies by browser, but as of right now, Chrome offers only one
checkbox to disable both 3rd-party cookies and 3rd-party localStorage
reads, so we can use neither to authenticate the hangout app's frame if
users are privacy-conscious.

Add "sockKey" and "userId" to the GD-param app data which is sent to the
hangout app via the hangout URL.  This feels a little dirty
security-wise, as we're now encoding everything an attacker needs to
impersonate the user in GET params -- but I believe it's adequately safe
because:

 - the GET vars are protected by SSL:
   https://stackoverflow.com/questions/323200/is-an-https-query-string-secure
 - Google rewrites hangout URLs immediately to remove all GET vars.
 - our frame isn't loaded with the GET vars; these are intercepted by
   Google, and all communication of them to our frame happens via CDM.

I can't figure any safer way to get a user's auth state into a google
hangout right now; but if we find one we might consider switching.