Failed RPC from sandboxed iframe to a content script in a Chrome packaged app

[liborbus]

RPC calls initiated from a sandboxed iframe fail with message:

No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'null' is therefore not allowed access.

Reason is that sandboxed iframe has null origin thus "*" shall be used instead null.