remove request.flash since it may be used outside of auth context