Restrict receipt to origin not appId (bug 1028326)

Should these errors be more specific? `NO_PRODUCT_URI` or something?