* Check url with homeserver
* Move check to where access-token is added
* Do IPC comm sparingly
Before, the code would fetch the hs for every request.
Since this needs the whole event-handler dance, it's best we do it only
for the requests that match the media endpoints.
Also added some try..catch since we create URL objects that could
potentially throw
* Check origin instead of just hostname