keep cross_domain_policy a string