Made the persistence of flash sessions more specific. Closes #49

Previously flash sessions would persist only if the HTTP request had a
valid satus code. This isn't specific enough to provide the correct
behaviour all the time. So now we explicity mark each response from
all controllers as `fromController`