We are not using the Web Adaptor and hitting the Tomcat server directly. We are getting security exceptions because we don't have the cross domain policies in place on Tomcat. Typically in Tomcat, you would place them in webapps/root but this doesn't seem to be working. ArcGIS has a lot of subfolders in the webapps folder. I am not sure which to use:
webapps
--arcgis
--arcgis#admin
--arcgis#manager
--arcgis#mobile
--arcgis#rest
--arcgis#services
--arcgis#tokens
I would assume that the cross domain policy would need to apply to the rest/services/tokens folders.
