iframe oauth flow.

Follow on for #1437. Review this.
Does this need a fallback for browsers that may not support `rgba()`?
Or maybe that only is IE8- (per http://caniuse.com/#search=rgba).