iframe oauth flow.

Follow on for #1437. Review this.
Should this throw an error or display some sort of message?