After the latest round of security reviews, we've decide to ditch the iframe in lieu of a popup. The in-app flow needs to be adjusted to always run in a popup. Here's the catch: an app can only have *one* popup. The in-app flow needs to support a browser ID login so keep that in mind.

This should be 99% frontend work- I'll tackle this and pull in Kumar when I hit a wall.

relevant b2g behavior: https://bugzilla.mozilla.org/show_bug.cgi?id=752666#c57 still seems like a moving target though. It's probably best to get this working on desktop first.

I'm stuck at browserid- I have to control the popup from user-click (to prevent popup blocking), and then would have to pop up a second window for sign in. Don't know what to do here.

now using a popup. still need to figure out how to make browserid play in our popup. we shall see! https://github.com/mozilla/zamboni/commit/ba5ae3e

What's the status of this?

this might be a thing with android but closing until we know