Support native app URIs

[jace]

We've missed an aspect of the OAuth 2.0 spec, these special redirect URIs:

• urn:ietf:wg:oauth:2.0:oob
• urn:ietf:wg:oauth:2.0:oob:auto

Details at https://developers.google.com/api-client-library/python/auth/installed-app#choosingredirecturi

Lastuser should implement support for these, and the native Android app should use these for the login flow.