Make OAuth friendlier to Cordova

Expose the credentialSecret and credentialToken in the url if there is no window.opener.

This will allow a Cordova app that is using an InAppBrowser to access them without needing to patch `OAuth. _endOfLoginResponse`.

More context at https://groups.google.com/forum/#!topic/meteor-core/Ma3XTZk4Kqg and https://github.com/AdamBrodzinski/meteor-phonegap-oauth/pull/5