iframe oauth flow.

Follow on for #1437. Review this.
I'm not exactly sure what to do with that yet. It might go away.