Merge pull request #32 from fmarier/origin_check_location

Move the origin check out of the try loop
Ensure that response was received from expected origin

Without this check, it's possible for another window or frame
loaded by the caller of WinChan.open() to send a message that
is interpreted as the WinChan response.

https://bugzilla.mozilla.org/show_bug.cgi?id=868967
Check each component of the relay frame origin separately

The current check against the origin we craft will succeed in the
case of a URL which merely starts with the same text as the
crafted origin.

An example is a URL like "http://example.com@hostile.com" which
would match an origin like "http://example.com".

https://bugzilla.mozilla.org/show_bug.cgi?id=878485
Use the browser's built-in URL parser to extract the origin

The original origin extraction code would fail to extract the
correct origin when passed URLs like "http://example.com@evil.com"
but it was only fed URLs configured by the developer using winchan
so it wouldn't lead to security problems.

This fix is intended to prevent problems should this function be
used for other purposes in the future.

https://bugzilla.mozilla.org/show_bug.cgi?id=878485