iframe oauth flow.

Follow on for #1437. Review this.
So, I hope this can go away. I'm not fully sure.