auth, sessions and flash alerts working