Issue 1386 iframed oauth flow

Here is iframing! based on `add-a-broker` and should be reviewed afterwards.
Does this get surfaced to the user? Maybe we should use "Unexpected error" like we do for the desktop channel timeout if so.