Write a Parsoid backend for VirtualRestService, and replace VisualEditor's and Flow's hacks with that. Incorporate the cookie forwarding hacks from VE as well.
See https://www.mediawiki.org/wiki/Requests_for_comment/PHP_Virtual_REST_Service and https://github.com/wikimedia/mediawiki/tree/master/includes/libs/virtualrest
This would also be a good opportunity to clean up the way the Parsoid URL (and whether it's available) is configured in mediawiki-config
See also: T74988