Clean up OAuth redirect and Cordova flows.

* Be less XSS-able by HTML-encoding 'config' in the end-of-login
  responses and reading it out of the DOM.
* Thread 'isCordova' through to end-of-login responses. Trying to do a
  'window.close' in Cordova, even in a try/catch, breaks the in-app
  browser.
* Remove some stray 'console.log's.