Right now the renderer provides the source ID (in the form of top frame's origin) to the recorder via mojo. While this is not a security concern, it is an anti-pattern to trust the renderer to describe its origin. 

We should instead get the Source ID (abstracted from origin) from the trusted browser process. A refactor to make this easier is tracked in  Issue 754889