BREAKING CHANGE: disable flask.session, everything must now use g.identity