do not leak FlashHash into the session value