It allowed Flash apps on any domain to make requests on
behalf of a signed in user.

Thanks to Oliver Beg for the hint.