OWASP -  alowscriptaccess to  sameDomain