lock the cross-domain policy to yoursecondphone only