fix postMessage origin check