Fixed hardcoded AUDIENCE path in sso.js
Restricted cross-origin requests to the contents of process.env.ALLOWED_DOMAINS
Restricted postmessage to ALLOWED_DOMAINS config value
Merge branch '_dev' of https://github.com/ksedge/login.webmaker.org into _dev