added secure=false to crossdomain policy