calling flash() should be performed only after passport.initialize and passport.session