Add URLS to window.postMessage for security