Allow location.origin for postMessage, send client_id to zamboni

I agree since it's not changing an encapsulated state or anything