We use `document` directly a bunch where that might not be the right thing if the event is occurring in an `iframe`. We should do it right. (split from #373)