The origin will be used to pass as the preferredOrigin to window.postMessage.
The main thing I'm worried about is that I'm not sure how credentials in the url (username:firstname.lastname@example.org) are handled.
http://email@example.com, and getting
http://frederikcreemers.be, so the origin doesn't include credentials. Would it be sufficient to add a condition like this to the function above:
if "@" in parsed.netloc: raise ValueError("The origin must not contain credentials.")