Safer handling on window.postMessage