make us jshint-safe
minimal OAuth workflow
update list of OAuth scopes
rename authenticate to "login"
example API calling
abstract Google login to service
disable HTML5 mode for URL bar

It doesn't play nicely with hosting the web app from non-root locations.