move popup methods to Popup.prototype
postMessage back to the parent window and instead of using wildcard *, send message only to the original source, e.g. localhost:3000