Use "*" for the target origin for compatibility with FF

The docs warn not to do this, but we're always posting
messages on iframes we create ourselves.