Other than the post recommendation, using a secure "blank" iFrame hosted on their own domain might have worked as well, depending on their threat-model.