Implements the "redirect" login flow, for cases such as using a mobile
UIWebView which aren't able to use the preferred "popup" login flow.

See the specs for details:
  https://meteor.hackpad.com/OAuth-redirect-flow-spec-PeziTcaNPDP
  https://meteor.hackpad.com/OAuth-redirect-flow-part-II-vswwUKP4vXe

I extracted code to construct a URL from the `http` package into a new
`url` utility package.  The new package has no public API, it simply
has the original URL construction functions that were in `http` and
makes them available to oauth.

Fixes the Meetup account login, as Meetup now requires using
"https://api.meetup.com/2/members" instead of
"https://secure.meetup.com/2/members".

The `?close` parameter for the redirect URI is now not needed or used.
For backwards compatibility the `?close` parameter is included if the
login service configuration doesn't include the `loginStyle` field
(indicating it was created using old code).
wip towards oauth
Clean up OAuth redirect and Cordova flows.

* Be less XSS-able by HTML-encoding 'config' in the end-of-login
  responses and reading it out of the DOM.
* Thread 'isCordova' through to end-of-login responses. Trying to do a
  'window.close' in Cordova, even in a try/catch, breaks the in-app
  browser.
* Remove some stray 'console.log's.
Code review comments from arbesfeld
Merge branch 'cordova-hcp-oauth' into cordova-hcp

Conflicts:
	packages/oauth/package.js
	packages/standard-app-packages/package.js