Use Capistrano, subdomain session tokens; fix routes