new IFrame messaging needs messaging API secured a bit better

[steveseguin]

will need to review the iframe messaging API a bit more; ensure the only target iframe/parent window gets the message.

Setting targetOrigin to "*" [:83] in postMessage [:83] may enable malicious parties to intercept the message. Consider using an exact target origin instead.

I could always even encrypt the chat messages, lol.

if(!key) { return; }
window.postMessage({
    action : PUBLISH_KEY, 
    key: key,
    data : data
}, '*');
};