Ensure that response was received from expected origin

Without this check, it's possible for another window or frame
loaded by the caller of WinChan.open() to send a message that
is interpreted as the WinChan response.

This could for example enable an attacker to inject their own
assertion into the login process and trick a user into loggging
into the attacker's account.

https://bugzilla.mozilla.org/show_bug.cgi?id=868967
Merge pull request #3760 from fmarier/train-2013.07.31+hotfix-868967

Train 2013.07.31+hotfix 868967