Check each component of the relay frame origin separately

The current check against the origin we craft will succeed in the
case of a URL which merely starts with the same text as the
crafted origin.

An example is a URL like "http://example.com@hostile.com" which
would match an origin like "http://example.com".

https://bugzilla.mozilla.org/show_bug.cgi?id=878485
Use the browser's built-in URL parser to extract the origin

The original origin extraction code would fail to extract the
correct origin when passed URLs like "http://example.com@evil.com"
but it was only fed URLs configured by the developer using winchan
so it wouldn't lead to security problems.

This fix is intended to prevent problems should this function be
used for other purposes in the future.

https://bugzilla.mozilla.org/show_bug.cgi?id=878485