Only use req.flash() in req.validate() if req.session() exists.