Session::setFlash instead of Auth::flash

$this->Session->setFlash() is used everywhere except in login where $this->Auth->flash() is used. By default, messages set via $this->Auth->flash() will not be output anywhere. I'm guessing this is a mistake and not deliberate, but if not, please disregard this patch.