change allowscriptaccess to sameDomain