Check the origin of messages sent to evalbox's frame.
Merge pull request #296 from mikewest/xss

Check the origin of messages sent to evalbox's frame.