I finally got it to work.
Here is the solution:
<access uri="http://ajax.googleapis.com" subdomains="true" />
<feature id="blackberry.invoke" />
<feature id="blackberry.app" required="true" version="1.0.0">
<param name="websecurity" value="disable" />
</feature>
So rather than nesting the feature inside the access, i separated it.