Allow location.origin for postMessage, send client_id to zamboni

i'd comment that