BCBREAK: Move validation after spam/captcha

Prevents spam/captcha entering the system
Allow `Croogo.referer` to take effect for string $url
Controller::flash() is deprecated. Change to SessionComponent::setFlash

- Redirect back to original (referer) page
Merge branch '1.6-contacts' into 1.6