Modified to abide by chrome packaged app security rules, communicates with iframe using POST messaging