Add a crossdomain.xml policy to the robots controller

This stops user-controlled sub-resources (like stylesheet.css on
opensource installs) from being interpreted as crossdomain policies

See: https://www.adobe.com/devnet-docs/acrobatetk/tools/AppSec/CrossDomain_PolicyFile_Specification.pdf
Mitigate "Rosetta Flash" exploits for users with outdated Flash

See http://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flash/ for details
OAuth: Add spamlistings
/dev/api: Document GET_spamlisting