Checking against top-level origin should use same origin-domain

[marcoscaceres]

In adherence to how platform objects are checking in HTML, we should check if an iframe's document is "same origin-domain" (i.e., ignore the port) with the top-level origin.