iframe oauth flow.

Follow on for #1437. Review this.
We should just ignore messages that do not come from the FxA host. Other IFRAMEs or windows could be legitimately posting a message to this window, in which case we don't want to interfere.