added non-restrictive cross-domain policy