small authentication refactoring, and now display google/openid error messages via connect-flash