Allow 'postmessage' callbackURL

@jaredhanson this should allow people to use the google-supplied javascript to render the g+ button. 

Fixes jaredhanson/passport-google-oauth#21

cc @praneshkmr @bhvaleri