postMessage recipient (iframe; same domain)