Google's javascript toolkit needs to go. It isn't reliably secure. Client oauth calls need to be made directly.