Getting access token for user owns data (UOD) using JavaScript

Thanks Dale for the reply!  I have all the components of the AAD approach in place except for the access token creation.  I have my app all setup and registered in AAD as required.  I also used the PowerBI-Developer-Samples code to test and grab the dashboard ID and embed URLs and confirmed that those work in my app (I'm able to see the tiles in my app using those IDs and the temporary access token generated by the sample code), etc.  However, I was assuming/hoping that the access token generation would be part of a standard javascript library such the powerbi-client Javascript library.  It sounds like it is not.  I will use the ADAL to generate it.  Perhaps this is because the token generation process would ideally be split between the browser and server with browser managing AAD sign-in, receiving the authorization code, passing that to the server which obtains the access token on behalf of the user (thus keeping the client ID and secret hidden)?  The browser then receives the access token from the server and uses it to request Power BI tiles, etc.  Is that the ideal flow?    

Further, looking at the OAuth 2.0 documentation, I assume that that for Power BI UOD embedded, we should be using the "Authorization code" grant type (as opposed to "Client credentials"). However, what's interesting is that I assume the resulting access token needs to be passed back to the browser so that the subsequent calls to powerbi.embed can be made using it.