fix for auth issues in IE11

Commit 25712916 merged in support for refreshing tokens. This necessitated re-writing the implicit OAuth2 flow implementation to allow for prompt-less login. The re-write made use of postMessage() to communicate the token back to the application. This worked in development on all browsers but when deployed a subset of installed IE11 boxes seemed not to allow the postMessage.

The postMessage flow has some advantages over polling the location object of the opened window. Not least that we don't have to perform some tricky try/catch behaviour to handle cross-origin permission errors when trying to access the location object of the window/IFrame. It also reduces latency; we are notified immediately when a new token is available rather than having to wait until the next poll.

This commit combines both mechanisms into one by keeping the postMessage flow but adding an additional poll via setTimeout to catch instances where IE11 doesn't allow the postMessage to succeed.

We could remove the postMessage flow entirely and rely on setTimeout but this would introduce additional latency for other browsers.