Safer handling on window.postMessage
Merge pull request #726 from Shopify/safer_post_message

Safer handling on window.postMessage