Reimplemented cross-domain checks

Instead of just avoiding file:// it actually checks the domain the url
has against the window domain.