Add restrictive crossdomain.xml file from html5boilerplate

Serve with content type text/x-cross-domain-policy