don't check for session flash if there is no token