Add allowScriptAccess opt and default to sameDomain