diff --git a/authtest.json b/authtest.json
new file mode 100644
index 0000000..1c42e48
--- /dev/null
+++ b/authtest.json
@@ -0,0 +1,7 @@
+console.debug('in authtest.json', [jsonp_url]);
+if (jsonp_url.indexOf('auth=') >= 0) {
+  jsonp([['ok'], [true]]);
+} else {
+  tryOAuth2('https://accounts.google.com/o/oauth2/auth' +
+            '?scope=https://www.googleapis.com/auth/spreadsheets.readonly');
+}
\ No newline at end of file
diff --git a/render.js b/render.js
index 0defc6d..82a1eef 100644
--- a/render.js
+++ b/render.js
@@ -1097,6 +1097,13 @@
   }
 
 
+  function checkUrlSafety(url) {
+    if (/[<>"''"]/.exec(url)) {
+      throw new Error("unsafe url detected. encoded=" + encodedURI(url));
+    }
+  }
+
+
   function getUrlData(url, success_func, error_func) {
     // some services expect callback=, some expect jsonp=, so supply both
     var plus = 'callback=jsonp&jsonp=jsonp';
@@ -1112,6 +1119,7 @@
     } else {
       nurl = url + '?' + plus;
     }
+    console.debug('fetching data url:', nurl);
 
     var iframe = document.createElement('iframe');
     iframe.style.display = 'none';
@@ -1120,6 +1128,46 @@
     // the default jsonp callback
     iframe.contentWindow.jsonp = success_func;
 
+    // a callback the jsonp can execute if oauth2 authentication is needed
+    iframe.contentWindow.tryOAuth2 = function(oauth2_url) {
+      var hostpart = urlMinusPath(oauth2_url);
+      var oauth_appends = {
+        'https://accounts.google.com':
+            'client_id=41470923181.apps.googleusercontent.com'
+        // (If you register afterquery with any other API providers, add the
+        //  app ids here.  app client_id fields are not secret in oauth2;
+        //  there's a client_secret, but it's not needed in pure javascript.)
+      }
+      var plus = [oauth_appends[hostpart]];
+      if (plus) {
+        plus += '&response_type=token';
+        plus += '&state=' +
+            encodeURIComponent(
+                'url=' + encodeURIComponent(url) +
+                '&continue=' + encodeURIComponent(window.top.location));
+        plus += '&redirect_uri=' +
+            encodeURIComponent(window.location.origin + '/oauth2callback');
+        var want_url;
+        if (oauth2_url.indexOf('?') >= 0) {
+          want_url = oauth2_url + '&' + plus;
+        } else {
+          want_url = oauth2_url + '?' + plus;
+        }
+        console.debug('oauth2 redirect:', want_url);
+        checkUrlSafety(want_url);
+        document.write('Click here to ' +
+                       '<a target="_top" ' +
+                       '  href="' + want_url +
+                       '">authorize the data source</a>.');
+      } else {
+        console.debug('no oauth2 service known for host', hostpart);
+        document.write("Data source requires authorization, but I don't " +
+                       "know how to oauth2 authorize urls from <b>" +
+                       encodeURI(hostpart) +
+                       "</b> - sorry.");
+      }
+    }
+
     // some services are hardcoded to use the gviz callback, so supply that too
     iframe.contentWindow.google = {
       visualization: {
@@ -1133,6 +1181,8 @@
       error(null, message + ' url=' + xurl + ' line=' + lineno);
     };
 
+    iframe.contentWindow.jsonp_url = nurl;
+
     //TODO(apenwarr): change the domain/origin attribute of the iframe.
     //  That way the script won't be able to affect us, no matter how badly
     //  behaved it might be.  That's important so they can't access our
@@ -1174,6 +1224,7 @@
       extractRegexp: extractRegexp,
       fillNullsWithZero: fillNullsWithZero,
       urlMinusPath: urlMinusPath,
+      checkUrlSafety: checkUrlSafety,
       gridFromData: gridFromData
     },
     render: wrap(_run)
diff --git a/setauth.html b/setauth.html
index e6d5737..776cde7 100644
--- a/setauth.html
+++ b/setauth.html
@@ -9,11 +9,23 @@
     (window.location.search || '?') + '&' + window.location.hash.substr(1));
 
 var token = args.get('access_token') || args.get('auth');
-var url = args.get('state') || args.get('url');
+var state = args.get('state');
+console.debug('state is:', state);
+var stateargs = afterquery.internal.parseArgs('?' + (state || ''));
+var url = args.get('url') || stateargs.get('url');
+var continue_url = args.get('continue') || stateargs.get('continue');
 var hostpart = url ? afterquery.internal.urlMinusPath(url) : null;
 
 if (token && hostpart) {
   localStorage[['auth', hostpart]] = token;
+  document.write('Authorization successful.')
+} else {
+  document.write('Authorization was rejected.');
+}
+if (continue_url) {
+  afterquery.internal.checkUrlSafety(continue_url);
+  document.write(
+      ' <a href="' + continue_url + '">Continue >></a>');
 }
 
 </script>