postMessage called through a different same-origin page