I am pretty confident that, when it comes to browser users, proof of work simply doesn't work. The disparity in speed between GPUs and javascript is so high that either you are a non-issue to a sane attacker or you make your users sit for a minute with their fans on full waiting to be able to sign in.

Would it be possible to conceive a proof-of-work that is difficult to parallelize, making it harder for GPU computing?

There are PoW systems which are designed to be difficult to run on ASICs, but modern GPUs can generally run them. Even if you find one that has to run on CPU, these kind of functions will still be much faster running in native code than in js/wasm.

bcrypt, litecoin

Argon2d on WASM at the very least. I would never suggest we use something as slow as JavaScript for a proof of work.