   @currentLocation: ->
     window.location.href
 
+  # Removes the OAuth 2 access token from the current page's URL.
+  #
+  # This hopefully also removes the access token from the browser history.
+  #
+  # @return undefined
+  @cleanupLocation: ->
+    if window.history
+      pageUrl = @currentLocation()
+      hashIndex = pageUrl.indexOf '#'
+      window.history.replaceState {}, document.title,
+                                  pageUrl.substring(0, hashIndex)
+    else
+      window.location.hash = ''  
+    return
 
 # OAuth driver that uses a redirect and localStorage to complete the flow.
 class Dropbox.AuthDriver.Redirect extends Dropbox.AuthDriver.BrowserBase

  resumeAuthorize: (stateParam, client, callback) ->
    if @locationStateParam() is stateParam
      pageUrl = Dropbox.AuthDriver.BrowserBase.currentLocation()
      window.location.hash = ''  # Remove the token from the browser history.
      callback Dropbox.Util.Oauth.queryParamsFromUrl pageUrl
    else
      @forgetCredentials ->

  @oauthReceiver: ->
    window.addEventListener 'load', ->
      pageUrl = window.location.href
      Dropbox.AuthDriver.BrowserBase.cleanupLocation()
      opener = window.opener
      if window.parent isnt window.top
        opener or= window.parent
