Public search query: how to store OAuth tokens securely in a single-page app