You could load gmail or facebook or any other site in an iframe and tell the user to login, but you would intercept his credentials with javascript.
Maybe a more secure alternative to iframes can emerge. Something like Chrome's WebViews.
Even though as of right now native browsers can intercept your data as well, it's a matter of trusting the tool.
Example: http://www.jayssite.com/misc/iframesample.html (not my site, I googled it)