a viewer can log in; a viewer can log out; add flash hash for messages