They're working on native first party isolation, but it breaks authentication via Facebook/Google/other OAuth vendors.

It's a tough problem, and I agree the grandma test is a good standard, sometimes it can't be easily done.