Fix client/server-side analytics race condition

We are seeing bad analytics data in Mixpanel because
we are not aliasing guests into users.

https://mixpanel.com/docs/integration-libraries/using-mixpanel-alias

Segment.io strongly recommends doing this client-side:

https://segment.io/docs/integrations/mixpanel/#alias

Restrict user-facing flash messages to a known whitelist
so we don't accidentally send `flash[:signed_up]` to the view.

https://trello.com/c/ZzJdRvJu
I've never seen `flash` used for storage like this. Is there a reason `session` doesn't fit the bill?