FxA web flow (bug 1033694)

does this have to post to ``*`` ? That seems dangerous since it leaks the query string.