WIP: Add OAuth->browser plumbing.

Should we rename `source` to something like `sourceFlow` or `loginType`?