session: use SessionNotification object for messages instead
everything: switch from flask's flash() to our own flash()