changed authenication failure message to use flash sessions