Add the iframe channel, use the iframe channel if iframed.

* Add a close button in the content.
* Start the shell of a CancelButtonView.
* allow /oauth/signin & /oauth/signup to be framed.
* The iframe channel does an ping with the parent window to determine origin, only whitelisted origins can be iframed.
* Non-whitelisted origins are sent to the `/illegal_iframe` endpoint.
* Start on an OAuth RP include.js with a callback based API.
* Add a check in env-test to determine whether the user is in an iframe.
* Hook up the close button if iframed.
* Add the GET /iframe_allowed endpoint, hook that up to the front end. This allows for the full check of whether an iframe is allowed for an origin.