modularize oauth stuff somewhat
add page to allow iframe logout