added crossdomain policy to routes