<cross-domain-policy>
    <allow-access-from domain="*" secure="false"/>
    <site-control permitted-cross-domain-policies="master-only"/>
</cross-domain-policy>