Change _endOfLoginResponse signature.

The main changes are:
* The `isSafe` check happens before _endOfLoginResponse is called. If
  _endOfLoginResponse gets a credential token/secret, then the values
  are safe to include in HTML.
* _endOfLoginResponse gets a little more information about the request
  (like the query string, and a string or Error describing any error
  that occurred).
* We preserve the <=0.8.1.3 behavior where you have to pass ?close in
  the query parameter to get the popup to be closed at the end of the
  OAuth flow.