Allow flash to be cleared after requests again

Looks like the change in bbd5dfa8c53fcb65257610f6cb72360dfcf5d3a2 prevented this from
happening. It appears to have been the original rebinding of the same name (`session`) that caused confusion when the request/response flash handlers got split out.