first draft HTTPBootstrapper, won't work 'til cross-domain policy probelm is resolved