fixing defect where no flash messages were triggered

updating example so that calling flash() should be performed only after passport.initialize and passport.session have been called.