feat(client): Smooth out the verification flow.

* The original tab always automatically completes the oauth flow if it is open when the email is verified.
* If a second tab is opened in the same browser, show the user a link to continue back to the RP.
* If the user verifies in a second browser, show the service name, but do not allow the user to click back to the RP.

fixes #1723
This can likely get simpler, but we still need to support the behavior in `afterRender` for WebChannels.