Do not load anything inside inner_iframe initially

Instead wait until it's (possibly) needed by the remote document
viewer.  When and if it's needed the viewer will set the src location
and load the frame then.
IE work for third party logins.

Discovered that IE will not access window.opener if site is
marked as 'trusted' in security settings or if the security
zone has changed for the window, and windowpostmessage can
fail unless a setTimout is used. Documented in comments.