AIR Server Ignoring Policy File Error Message?

So I’m trying to set up a policy
file in an AIR server I made for a Flash game I’m making, and it just
throws this error at me whenever a client attempts to connect,
immediately followed by the client disconnecting:

Error: [strict] Ignoring policy file at http://security-app.xml/ due to incorrect syntax. See http://www.adobe.com/go/strict_policy_files to fix this problem.

This is the socket policy file:

<?xml version="1.0"?><!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd"><cross-domain-policy><allow-access-from domain="*" to-ports="*" /></cross-domain-policy>

And here’s how the AIR server loads it up:

function connectHandler(event:ServerSocketConnectEvent):void{  
var socket:Socket = event.socket as Socket;  
clientSockets.push( socket );   
socket.addEventListener( ProgressEvent.SOCKET_DATA, socketDataHandler);
socket.addEventListener( Event.CLOSE, onClientClose );
socket.addEventListener( IOErrorEvent.IO_ERROR, onIOError );    socket.addEventListener(ProgressEvent.SOCKET_DATA, loadComplete);   //<-----    
log( "A client has successfully connected to the server.");} 

function loadComplete(e:Event):void{  
security.load(new URLRequest("security-app.xml"));  
securityContent = XML(security.data);   
securityContent.ignoreWhite = true;   
Security.loadPolicyFile("security-app.xml")   
removeEventListener(Event.COMPLETE, loadComplete);} 

I’ve looked allover the place and can’t seem to find an answer. Some say I’m supposed to put this in the client NOT the server, others say otherwise… the clients connect just fine when they’re on the same machine or over the LAN, but when I put the client on a website or try to connect from a different person’s house completely, that’s when I get this socket policy error. Any ideas? Thanks.