authentication in an iframe fails with some browser settings

[epixode]

This issue presents itself as a TokenMismatchException in VerifyCsrfToken.php.

It happens in browsers where the "Block third-party cookies" option is enabled.
Enabling this option causes cookies for X not to be sent along with request made by a domain X iframe embedded in a domain Y page (X != Y).

As a result, authentication in an iframe fails when this setting is enabled.

The issue can be fixed by doing authentication in a popup window instead of an iframe.