added security domain, will fail if loading local files.