Do not hide actual errors behind 404, sweep flash

- default route for '/:action' will display actual error, not 404
- flash hash is sweeped on every request, flash contents not preserved until used