LEDGE-253: perform AJAX communication in an iframe loaded from
dedicated SSO domain
LEDGE-253: use origin request parameter to determine referer domain,
when provided