message in session should be stripslashes() too