Another "feature" would be the ability to use it without dropbox--save functionality removed. I don't have my dropbox password handy, so the app is completely unusable. (HTML"5" database/ javascript localstorage?)
How far do you plan to go with this? You could certainly make a buck or two if, say, you start offering a premium IDE with auto-complete, server-side compilation, etc. Not sure there's a big demand for this. Maybe you could sell this to enterprises and they could just deploy a lots of thin clients--save some cash on powerful workstations--and can log in from anywhere to develop and compile the code server-side and seamlessly deploy. But I'm just thinking out loud now. Best of luck.
Judging by your response, it's clear that there isn't a bug, and you either just don't know how OAuth works or you don't understand what an active session is. OAuth doesn't require an active session on a website, and an active session is having a page loaded in your browser.
The OAuth web flow requires an active session on dropbox.com. Without an active session Dropbox can not verify who the user is.
You still didn't answer my question about how a frame would help. Iframes should never be used to to embed OAuth provider authorization pages and embedding dropbox.com in general would be pretty useless if the user does not have an active session open.
As far as active sessions go dropbox.com is going to have two kinds authenticated and anonymous. Since we are clearly talking about access to users Dropbox accounts the only type of active session that would be useful would be authenticated.
I thought you were saying that you couldn't get the Dropbox API authenticated using OAuth working unless you had a continuous active session on dropbox.com. Sorry for the misunderstanding.