Fixed to support IE8.
Removed console.log() call used for debugging.
We can't guarantee synchronous requests, so don't try.
Check that the parent window has the same origin before passing the auth code.