AJAX loading of payment form changes window.location(), breaks submission to HostedPCI

First off, sorry for all the bug reports!!

Please also forgive me if I explain this poorly. I'm pretty good at figuring things out but I'm not a very experienced developer.

I've been trying to update Commerce Hosted PCI to work with Commerce Card on File 7.x-2.x in order to use rules to charge recurring payments (with hopes of contributing it back, maybe as a 2.x branch). I've run into an issue that I also noticed when I first set up Commerce Hosted PCI but didn't fully explore until now. If you have multiple payment options (for instance Check / Credit Card / Cash), it (obviously) loads the payment form for each payment type through an ajax call. Tha ajax call updates window.location() to "system/ajax" instead of the url of the checkout page (on our site it is "checkout/(order_id)/review") which breaks the js that HostedPCI uses to submit the data in the iFrame and get the response back, I believe because jquery.ba-postmessage uses window.location.

I got around this originally (sort of) by making HostedPCI as the default payment option which loads the credit card form with the page load and there are no issues. If a customer picks "Check" as payment type but then clicks back to "Credit Card" the submission is broken because the credit card form is reloaded through ajax. As well, in trying to integrate Card on File, if the customer tries to use a different card than the original one they used, it again loads the form through ajax and breaks the submission.

Does anyone have any idea how to get around this? I assume that HostedPCI won't or can't change the way they receive submissions, so it seems like we need to find a way to spoof window.location after an ajax call or remove the ajax entirely and load all the payment type forms and then use #states to show / hide them as neccessary. I've tried hard coding the correct url into the iFrame code (in commerce_hosted_pci_submit_form()) but jquery.ba-postmessage doesn't use that value but window.location still so it still breaks. I've already spent 10+ hours trying to fix this without success so if anyone with more experience has any ideas it would be truly appreciated.