We are still specifying it; we're just doing it dynamically.

Basically, our policy is: Only accept messages sent to / received from the current origin. Which could be `http://localhost:8000`, `http://localhost:8023`, `http://int3.github.io/`, etc.