Cross-domain POST using window.postMessage