do not infer response status if nothing's returned
add flash session objects that auto delete after first get
update HTTP POST processing to handle files better