Pointless to set session.flash before session.renew

The logout message would be removed by session.renew => this commit switches the order of action