Remove allow-same-origin flag
Change origin to * when posting from nested non-Oasis iframe