session flash now works