SAMEORIGIN exception handling

* Moving on to checking $_SERVER['SCRIPT_NAME'] against fully qualified
URLs for increased specificity
* Tentatively letting /wp-admin/post.php be loaded inside iframe, when
redirected from press-this (save draft)