Change flash allowScriptAccess from 'always' to 'sameDomain'

Fixes opscode/chef#1762.