WIP: iframe oauth flow.

Follow on for #1437. Not fully ready for review, but feedback on the approach/RP API would be useful.
Should this be hardcoded to localhost, or pulled from some config?