Sorry for resurrecting an old post, but I thought I should clarify in case someone comes across this post. Niels, you are right, it is intended to work just as in Play 1, the flash scope is available for the next request.
The problem here is most likely that your login page is making a call to download some assets or something like that, so the next request is not the sign in request, its a request to download an image, js, css, whatever. This request causes the flash scope to be cleared.
Flash scope is intended primarily to be used in situations when you are 99.9999% sure that the next request will be the request it's intended for. This basically only applies to redirects.