I had thought that I could not add my local map services to an ArcGIS online account. But there is some documentation about using a clientaccesspolicy.xml to allow the ArcGIS online application to gain access to my local map services. Where does one put that file exactly? Some say in the inetput/wwwroot folder, other's say??? Also, would one want to be specific about the URL allowed - say only www.arcgis.com/explorer so as to minimize any potential hacking?