no need to set flask_security form
don't redirect to '/'; show a message