fixing bug where no flash messages would trigger

updating example so that calling flash() should be performed only after passport.initialize and passport.session have been called.