Quick question: why do you need to normalize the origin? Is it ever passed in by the browser runtime un-normalized?

i..e, why couldn't you have written:

  if (e.origin !== 'https://clef.io') {