Cannot access ClientAccessPolicy.xml

I'm not sure whether this is more of an IIS question but here goes:

I have a Silverlight application that needs to access a WCF web service (hosted in IIS 6.0) located on a different domain, so I create the ClientAccessPolicy.xml and stick it in the service's web site root.

What I then get is 401.3 errors when the silverlight application tries to access it.

Now here comes the funny bit, having gone over all the NTFS and IIS permissions I could think of , without success, I discovered that I could access it if I changed the extension to .svc (but not if I changed it to .html, .txt, .abc).
I could also access it if I moved it to another web site on the same server, which has as far as I can see has identical permisioning.

Is there another source of permisioning, based on file extensions, hidden away somewhere?

<?xml version="1.0" encoding="utf-8" ?>
<access-policy>
  <cross-domain-access>
    <policy>
      <allow-from http-request-headers="*">
        <domain uri="http://*"/>
        <domain uri="https://*"/>
      </allow-from>
      <grant-to>
        <resource path="/" include-subpaths="true"/>
      </grant-to>
    </policy>
  </cross-domain-access>
</access-policy>

change <domain uri="*"/> as below example.

 

<?xml version="1.0" encoding="utf-8" ?>
<access-policy>
  <cross-domain-access>
    <policy>
      <allow-from http-request-headers="*">
        <domain uri="*"/>
      </allow-from>
      <grant-to>
        <resource path="/" include-subpaths="true"/>
      </grant-to>
    </policy>
  </cross-domain-access>
</access-policy>