title: Using devise "rememberable" without cookies
body: <p>I have a working Rails site that uses <a href="http://github.com/plataformatec/devise" rel="nofollow">devise</a> to manage users.  For session management, I am using devise's <a href="http://rdoc.info/github/plataformatec/devise/master/Devise/Models/Rememberable" rel="nofollow">rememberable</a> strategy, which stores and retrieves encrypted authentication information from a user's cookie.</p>
  
  <p>I'm implementing a multi-photo upload widget that uses flash.  Flash does not support sending cookies along with requests.  This is a problem with multiple multi-upload flash+javascript libraries, so fixing this shortcoming is probably not feasible.</p>
  
  <p>So my question is: can I successfully authenticate to devise/rememberable <em>without using cookies</em>?  And if so, how?</p>
  
  <h3>More details</h3>
  
  <p>Devise/rememberable depends on the value of <code>remember_token</code> within the cookie.  If I could fool Rails into thinking that the value was supplied as a cookie (e.g. <code>request.cookies['remember_token'] = '...'</code>), my problem would be solved.  Devise/rememberable would find the correct value there, unpack it, and successfully authenticate.  However, the <code>request.cookies</code> hash is apparently read-only.  Writing to the hash is silently ignored.  Example (debug console from an incoming POST request):</p>
  
  <pre><code>&gt;&gt; request.cookies['remember_token'] = 'a string'
  =&gt; "a string"
  &gt;&gt; request.cookies['remember_token']
  =&gt; nil
  &gt;&gt; request.cookies
  =&gt; {}
  </code></pre>
  
  <p>I'm using (or trying to use) the <a href="http://digitarald.de/project/fancyupload/" rel="nofollow">FancyUpload v3</a> widget.</p>