Pickup the token and secret from the InAppBrowser's url hash.

Since we do not rely on executeScript this will work if Content Security Policy prevents inline scripts.