Add Single-signon support

A site can provide credentials to an embeded client via a url fragment.
btoa(JSON.stringify({user: `username`, secret: `password/token`))