multiple fixes.

in the upload:
the first user always has access to the users page.
the pos module check if the two config setting are set that would allow
circulair logic if so it will return a alert and block entry.

and i have removed the massageStack-> add_session all alerts will be
added to the session variable. This should also prevent alerts in
classes that wouldn't show.