A major issue I haven't seen mentioned below is that for auth things like paypal or other logins you need to show the root security context is from the site you

A major issue I haven't seen mentioned below is that for auth things like paypal or other logins you need to show the root security context is from the site you are authenticating to. You can do that by either moving the whole window to the login page, which can be jarring and cause users to be confused, or you can do a popup. Some sites choose one, some choose the other. When you have active things going on on the first site, it really causes the drive to a popup.