fixed defect where no flash (error/success) messages would be displayed due to wrongly placed flash() call (it should go after passport.initialize and passport.session)