Hidding app_key and app_secret inside a possible desktop app

I stumbled upon this topic and found the display_token URL (which doesn't seem to be mentioned anywhere in the docs, BTW), but I can't get it to work. I think I have set up everything correctly. I can get it to redirect to https://www.dropbox.com/1/oauth2/display_token?code=<code_here>, but the code is only visible in the URL bar, and the "copy this token" box does not get populated. This is not a smooth experience, but it seems to be almost-there. Is it an issue with the page itself or could it be my configuration?