allow cross-origin postmessage
fix check for cross-origin iframe
allow postMessage from same-origin or any wordpress.com domain (for VIP sites)
allow http://chartbuilder.dev for cross-origin development
explanation of *
Merge pull request #3 from dmachat/cross-origin-postmessage

enable cross-origin postMessage