Safer handling on window.postMessage

The Batman chrome extension needs to be able to use window.postMessage, and the current behavior of Batman throws an exception if `event.data` is not a string - as it attempts to search it without checking it's type.

This simply adds a small type check before the search method is called.

@hornairs @nickjs for review