'error' and 'auth.error' are ways around the key issues. Having only one flash messages is a bit limiting I think. I know at work we have pages with more than one type of flash message.