The hosted mode debugger chokes on our return redirect now,
and I cannot figure out why. So we use a top level page
instead, even if the site would have allowed it.

Not all OpenID providers permit their login pages to be
embedded into an IFRAME. Only those that we know work
are permitted to stay inside of the IFRAME, everyone else
has to use this logic to replace the page with that of the
provider, and eventually redirect back to the same anchor.
