Describe the bug
Related to: #1138
Event listener process login operation without checking the origin of message. It is a potential vulnerability issue.
The origin is checked. If it does not match it logs an error but still continues.

Code location: oauth-service.ts —> setupSilentRefreshEventListener

Expected behavior
setupSilentRefreshEventListener should check the message origin and do try login only if message origin is expected origin.

Explanation
https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage#security_concerns