Always postMessage with origin "*".

Since global.location.hostname is neither reliable nor necessary for
security (thanks to the event.source === global and messagePrefix checks),
we should just do the same thing in every environment.