Safari 5: Refused to load an object (GoogleSites flash player)

I made a (quick) website for a composer friend 开发者_开发问答on Google Sites to be economical. I added a Flash player to the site so that his music would be streamable online.

All of this went swimmingly until Safari 5 came out.

The Flash player is not loaded on Safari 5. Worked fine on Safari 4.

I imagine this could be related to Google redirecting from the original resource URL, but I really don't know though.

The error console notes:

Refused to load an object. URL found within request: "http://www.rossbauermusic.com/resources/player_mp3_normal.swf"

The URL of the requesting page is: http://www.rossbauermusic.com/engage

Any thoughts about how to work-around this issue? Any alternate "on request" mp3 strategies are appreciated.

A quick Google turned up some evidence that this is likely related to a WebKit bug/feature enabled in Safari 5, the XSS Auditor. A related answer is here:

How can I get around Safari's XSS auditor for rendering remote flash objects on POST?

That answer discusses using the "X-XSS-Protection: 0" header.

And here's how you can disable it on the client:

Disable XSS filter in Safari/WebView

You can also send a special header along with the page, but that's probably not an option in Safari.