Remove stuff that tries to violate origin policy

How did I think this worked before?!  Maybe I tested on byu.edu origin.

The main thing still works because a frame can call a function in its
parent (at least in Chrome and Firefox), allowing us to pass snooped data
if we got it, or timeout if CAS is blocking waiting for user input.