user auth fixed. flash messages enabled