An FYI for everyone. The Wordpress plugin was not expected to be used for Universal Login and Embedded (Lock). When using embed the token authorization authentication needs to be set to none, which is not secure OAuth. Auth0 support had a great dialog with me about this, and I have decided to redo all my login needs to use Universal Login.
Nothing is broke here…the documentation around the plugin needs some clarifications.