This is a solution that is embedded in Dynamics CRM. We cannot change the web.config file or change the trust level for the Silverlight Xap.
Both the clientaccesspolicy.xml and crossdomain.xml are available in the root of the .ashx file:
full ashx file: https://wf.huntandlock.com.au/DMSDev1/DocumentRequiredUploadHandler1.ashx
This url will change for production so no issues in posting here.