Manage the Twitter OAuth dance without requiring cookies, since this makes it impossible for CORS clients