gorse: use session for flash messages