Fixed hardcoded AUDIENCE path in sso.js
Foo-fixes
Fixed hardcoded AUDIENCE path in sso.js
Restricted cross-origin requests to the contents of process.env.ALLOWED_DOMAINS
Restricted postmessage to ALLOWED_DOMAINS config value
Merge branch '_dev' of https://github.com/ksedge/login.webmaker.org into _dev
Merge pull request #4 from ksedge/_dev

Fixes #1, #2, #3 - Fixing security bugs