Server specifies targetOrigin as '*'

I noticed that in the server code, the postMessage call has a targetOrigin parameter of '*', but from these docs it says you should specify a specific uri:

```
clientWindow.postMessage(JSON.stringify({postmessageClientServerInit: true}), '*');
```

https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage
"Always provide a specific targetOrigin, not *, if you know where the other window's document should be located. Failing to provide a specific target discloses the data you send to any interested malicious site."

Do you think this uri should be set as the parent's uri?