Other than the useless Security.allowDomain call that looks okay. Be sure you are testing on an actual webserver and not just from the file system.