Rename `closePopup` to `OAuth._endOfLoginResponse`.
Nick's comments
Remove dead ?redirect OAuth flow.

This code has never worked without some fairly serious client-side
surgery, and it now especially doesn't work because it doesn't
communicate the credentialSecret back to the app. Rather than leave an
untested, unQA-ed code path in core, apps that are using the ?redirect
flow can just override `OAuth._endOfLoginResponse` to do the redirect
themselves.
Change _endOfLoginResponse signature.

The main changes are:
* The `isSafe` check happens before _endOfLoginResponse is called. If
  _endOfLoginResponse gets a credential token/secret, then the values
  are safe to include in HTML.
* _endOfLoginResponse gets a little more information about the request
  (like the query string, and a string or Error describing any error
  that occurred).
* We preserve the <=0.8.1.3 behavior where you have to pass ?close in
  the query parameter to get the popup to be closed at the end of the
  OAuth flow.
Nick comments
Add a missing return
Merge branch 'export-oauth-close-popup' into devel