Remove allowDomain("*") and allowInsecureDomain("*").
Use only FlashVars and ignore parameters passed via query string.