How do you get the URL, or simply the query string parameters, of the page that host the app and get past cross site scripting restrictions?

I am developing an App using the NAPA tools in Office 365. How do you get the URL, or simply the query string parameters, of the page that hosts the app?

I've read that you can get it from the URL of the Iframe that displays the app part. I don't see anything in the url that refers to SPHostPageURL. Not sure how to add it using the Office 365 tools.