Reworking original proposal

* Mistakenly removed XSS forbiding iframing, reverted
* Enforcing to reply postMessage ONLY if part of an accepted origin