flashes redirect + sha1