WIP: iframe oauth flow.

Follow on for #1437. Not fully ready for review, but feedback on the approach/RP API would be useful.
Not sure if we should convert this to some `Session.isDesktopContext` similar to `Session.isOAuth`.