uia fallback example: check event origin

specification/client_server_api.rst

@@ -637,7 +637,8 @@ handle unknown login types:
       var popupWindow;
 
       var eventListener = function(ev) {
-          if (ev.data !== "authDone" ) {
+          // check it's the right message from the right place.
+          if (ev.data !== "authDone" || ev.origin !== homeserverUrl) {
               return;
           }