use server side oauth.

the login button does not use xhr because of CORS.