OWASP -  alowscriptaccess to  sameDomain

mediaelement.js is triggering 2 OWASP security alerts.
1. is for the use of AllowScriptAccess always and can be addressed with this pull.
2. is described as "This SWF constains DEBUG and DEBUGFILE opcodes which reveals the local directory structure of the machine used to create the Flash application as well as line numbers. An attacker can then potentially leverage this information to exploit the application."

i will submit a second pull removing the debug information from display.

not sure if either of these changes will work with your current system of demo code and videos being loaded cross domain.