Allow to signin from Flash: enable token_authenticable, allow to create session from JSON, do not depend on session data to access auth routes, add crossdomain.xml