allow postMessage from same-origin or any wordpress.com domain (for VIP sites)