Pickup the token and secret from the InAppBrowser's url hash instead of executeScript.

This will work if Content Security Policy prevents inline scripts.