I think the "allow-access-from domain" should be set according to where the client will be hosted. If you want a SWF running in a standalone flash player or hosted on some unknown domain to be able to run tests against the server, then the option should be set to "*".