Renamed sword to sword.js, hosted in iis.  Web security issues resolved.