Extra safeguards.

Project manager calls preventDefault() on "links"
background.js rejects messages without a command property.