Don't use hardcoded localhost for postMessage origin check