A warning on cross-domain policy linking