prevent other [window.onmessage] event handlers from being called

Some websites have some global postmessage event handlers that behave badly on incorrectly formatted data, make sure we prevent them from running.