move delete

oauth3.browser.js

@@ -112,9 +112,9 @@
         var tok;
 
         function cleanup() {
-          delete window['--oauth3-callback-' + state];
           clearTimeout(tok);
           tok = null;
+          delete window['--oauth3-callback-' + state];
           // this is last in case the window self-closes synchronously
           // (should never happen, but that's a negotiable implementation detail)
           if (!opts.reuseWindow) {