Specify origin in popup postMesssage. The message is sensitive in OAuth 2.