[security] Verify message source in Firefox add-on

And put initPassiveLoading within a preprocessor block because
it is only used by Firefox.
Merge pull request #4197 from Rob--W/firefox-verify-message-source

[security] Verify message source in Firefox add-on