Remove the ability to redirect back to an RP on email verification. Update reset password to sign the original browser in on verification.
Allow the Sync/OAuth flows to complete when a user completes password reset in the same browser.

Use localStorage as the cross-tab communication to shuttle unwrapBKey/keyFetchToken from the new tab to the old tab, with the help of a library called crosstab.