Simplify how the iframe allowed check is done - instead of whitelisting a set of sites, get the redirect_uri for the client_id. Compare the origin of the redirect_uri with the origin returned from the `ping` postMessage response.