Scoped messages

Allow scoping of messages. Took longer than I thought, but I think I like the final implementation.

Highlights:
 - Tests work now
 - Automatically sanitize the flash messages with `ngSanitize` (needed for the above)
 - Flash messages are not stored on the rootScope and can be overridden by passing in a custom scope.

Notes/Questions:
 - I'd like to use a getter for `messages`, but it doesn't seem like there's a well supported way to do this (browser compatibility issues with `object.defineProperty` and `get messages()`)
 - Only tested via tests, working on manual testing now
 - Weaker unit tests compared to integration tests. This is because I started with integration tests. I don't think adding additional unit tests is going to provide more coverage. Let me know if you disagree.

cc @ejholmes @jerrysu 
Should this behavior be a configuration option? I can imagine that there me be scenarios where we'd want to turn this off.