only send notifications when app and parent domains match; direct notifications explicitly to parent origin