message: improve origin check of ScalarMessaging postmessage API.
  ensures that can't access the API.
  many thanks to for pointing out the potential vuln.
  cc in case this bug has been transplanted elsewhere.
diff: @@ -563,7 +563,7 @@ const onMessage = function(event) {
  const url = SdkConfig.get().integrations_ui_url;
  if (
  event.origin.length === 0 ||
  - !url.startsWith(event.origin) ||
  + !url.startsWith(event.origin + '/') ||
  !event.data.action ||
  event.data.api // Ignore messages with specific API set
  ) {
  